Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-68586 in SiYuan concerns cross-boundary content disclosure. Specifically, the /api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc API endpoints were found to return the rendered DOM of blocks from publish-forbidden documents to unauthorized users (anonymous readers or publish RoleReaders) without proper access checks. This allowed for the bypass of administrator-configured content restrictions.
The provided patch, commit f45749a7ef6e385f6e2af6b7dd12429d56d46f32, directly addresses this issue. Analysis of the kernel/api/ref.go file in the patch shows that both getBacklinkDoc and getBackmentionDoc functions were modified to include a new access control check. Specifically, a call to isBacklinkDocAccessible(c, refTreeID) was added at the beginning of both functions. If this check fails, the functions now return an empty result, preventing the disclosure of forbidden content.
This modification clearly indicates that, prior to the patch, these two functions executed their logic and returned sensitive data without verifying the user's authorization to access the refTreeID. Therefore, kernel/api.getBacklinkDoc and kernel/api.getBackmentionDoc are the vulnerable functions that would appear in a runtime profile when this vulnerability is exploited, as they are the direct entry points that process the request and return the unauthorized content without sufficient validation.
kernel/api.getBacklinkDockernel/api/ref.go
kernel/api.getBackmentionDockernel/api/ref.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260721014413-f45749a7ef6e | 0.0.0-20260721014413-f45749a7ef6e |