Kernel: SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

CVE-2026-68584 affects SiYuan's kernel component in its publish mode. The vulnerability arises because the password protection is enforced only on the primary content retrieval endpoint (`getDoc`) via `FilterContentByPublishAccess`. Other endpoints such as `getHeadingChildrenDOM`, `getHeadingDeleteTransaction`, `getHeadingLevelTransaction`, `getHeadingInsertTransaction`, `getBacklinkDoc`, and `getBackmentionDoc` return rendered content without performing any password checks. Additionally, the document's internal block and heading IDs are leaked through reader-accessible endpoints like `searchEmbedBlock`, which filters content but retains block IDs. This chain allows an anonymous user to retrieve the full content of a password-protected document without providing the password, effectively bypassing the intended access control.

An anonymous user or any user with the publish RoleReader can bypass the password protection on documents marked as 'protected' in SiYuan's publish mode. This leads to unauthorized disclosure of the full content of password-protected published documents. The confidentiality of sensitive information is compromised, violating the product's documented access control guarantees.

A patch is available to address this vulnerability. It is recommended to apply the official fix from the vendor to ensure that all content-returning endpoints enforce the publish-password check consistently. Until patched, avoid exposing publish mode with password protection enabled in environments where unauthorized access is a concern.