CVE-2026-68587 describes a missing authorization vulnerability in SiYuan note-taking software affecting versions prior to v3.7.3. The endpoints getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction return rendered block DOM content without verifying publish-access permissions. As a result, unauthorized users, including anonymous readers or users with only publish RoleReader tokens, can supply a heading block ID to retrieve the full rendered content of publish-disabled documents that should be access-restricted. This leads to a high-severity information disclosure issue.

Unauthorized disclosure of sensitive or restricted document content is possible. Attackers without proper authorization can access full rendered content of documents that are intended to be publish-disabled, potentially exposing confidential information. The vulnerability does not require privileges or user interaction and has a network attack vector, making it highly exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, restrict access to affected endpoints and monitor for unauthorized access attempts if possible.