High severity8.6OSV Advisory· Published Aug 3, 2026· Updated Aug 26, 2026
CVE-2026-68587
CVE-2026-68587
Description
SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260721013353-69db783b782a | 0.0.0-20260721013353-69db783b782a |
Affected products
3- osv-coordsRange: < 0.0.20260916T180043-160000.1.1
v3.7.3-beta.2, v3.7.3-beta.1, v3.7.0-rc.2, …+ 1 more
- (no CPE)range: v3.7.3-beta.2, v3.7.3-beta.1, v3.7.0-rc.2, …
- (no CPE)range: <v3.7.3
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-69mh-gvh4-8gp7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-68587ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/69db783b782aea865ea70a1c5ab656e5c0f3dadbghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-69mh-gvh4-8gp7nvdWEB
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getheading-transactionnvdWEB
News mentions
1- Siyuan Note: Eight Critical and High-Severity Vulnerabilities Disclosed TogetherVypr Intelligence · Aug 3, 2026