Duplicate Advisory: SiYuan: Cross-boundary content disclosure via getBacklinkDoc/getBackmentionDoc (publish mode): reader-reachable rendered DOM of publish-forbidden docs; sibling list endpoints…

SiYuan versions prior to 3.7.3 fail to enforce publish-access restrictions on the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc endpoints. Although backlink list endpoints correctly filter out publish-forbidden documents, these content endpoints only require authentication checks without applying publish-access filters. Consequently, unauthorized readers can directly query these endpoints with IDs of restricted documents to obtain their rendered DOM content and confirm references within those documents. This represents a cross-boundary content disclosure vulnerability classified under CWE-862.

An attacker or unauthorized user with reader-level access, including anonymous users if Basic Auth is disabled, can access the rendered content of documents that should be restricted from publishing. This leads to a confidentiality breach, exposing potentially sensitive document content without proper authorization. The vulnerability does not impact integrity or availability but results in high confidentiality impact.

A fix is available in SiYuan version 3.7.3 and later, which properly applies publish-access filters to the affected endpoints. Users should upgrade to version 3.7.3 or newer to remediate this vulnerability. No additional mitigations are specified or required beyond applying the official fix.