CVE-2026-72812 describes a missing authorization vulnerability in the SiYuan note-taking software prior to version 3.7.4. The issue exists in the /api/ref/refreshBacklink endpoint, which does not properly restrict access, allowing unauthenticated attackers to invoke it with arbitrary block IDs. This leads to flushing transaction queues, scanning all references globally, and enqueuing database writes. The vulnerability bypasses intended read-only protections and can be leveraged for resource amplification attacks against the server.

An attacker can perform unauthorized persistent writes on the server by exploiting this endpoint without authentication. This bypasses read-only restrictions and may cause increased resource consumption due to amplified database operations. There is no indication of remote code execution or data disclosure from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/ref/refreshBacklink endpoint or implement additional access controls to prevent anonymous invocation.