https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 06 Sep 2026 18:25:49 +0000 https://vulnerability.circl.lu/sighting/ef40026a-862a-476e-b210-47f6878e0e2d/export {"uuid": "ef40026a-862a-476e-b210-47f6878e0e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://gist.github.com/alon710/4d2d0e14cc9fbf8c2c4ec8fd41b0edff", "content": "# GHSA-7J72-F6WG-CXW6: CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6\n\n## Summary\nAn authentication bypass vulnerability (classified as CWE-288) exists in the publish-mode component of SiYuan, a Go-based note-taking application. This security flaw allows unauthenticated remote attackers to bypass password-protected note boundaries by leveraging auxiliary block endpoints that fail to enforce document access checks. Attackers can exploit this issue by first harvesting document metadata via a public search endpoint and subsequently fetching full rendered document contents using vulnerable block endpoints. This technical analysis explores the root cause, exploitation methodology, and remediation path.\n\n## TL;DR\nAn unauthenticated remote attacker can bypass password protection on published notes in SiYuan by retrieving block IDs through search metadata leaks and querying auxiliary block endpoints directly.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6\n- **EPSS Score**: Not available\n- **Impact**: High (Complete loss of confidentiality of protected documents)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan (Go Kernel Backend)\n- **SiYuan**: < 0.0.0-20260721020826-2d069dce84a2 (Fixed in: `0.0.0-20260721020826-2d069dce84a2`)\n\n## Mitigation\n\n- Upgrade to the latest patched version of SiYuan.\n- Deploy a reverse proxy (e.g., Nginx) to block external access to vulnerable auxiliary block API endpoints.\n- Limit access to the SiYuan publish-mode port (6808) to trusted networks or IP addresses.\n- Disable publish mode entirely if it is not required for daily operations.\n\n**Remediation Steps:**\n1. Identify all running instances of SiYuan in the environment.\n2. Verify the version of each instance by checking the kernel build metadata.\n3. Apply the patch by updating the container image or application binary to version 0.0.0-20260721020826-2d069dce84a2 or newer.\n4. If patching is delayed, update reverse proxy configurations to deny unauthenticated traffic to /api/block/getHeading routes.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-7j72-f6wg-cxw6)\n- [SiYuan Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j72-f6wg-cxw6)\n- [Fix Commit](https://github.com/siyuan-note/siyuan/commit/2d069dce84a25c959ef0093c72c98e05778ef218)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-68584)\n- [VulnCheck Threat Intelligence Advisory](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-content-endpoints)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T22:31:26.470700Z"} {"uuid": "ef40026a-862a-476e-b210-47f6878e0e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://gist.github.com/alon710/4d2d0e14cc9fbf8c2c4ec8fd41b0edff", "content": "# GHSA-7J72-F6WG-CXW6: CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6\n\n## Summary\nAn authentication bypass vulnerability (classified as CWE-288) exists in the publish-mode component of SiYuan, a Go-based note-taking application. This security flaw allows unauthenticated remote attackers to bypass password-protected note boundaries by leveraging auxiliary block endpoints that fail to enforce document access checks. Attackers can exploit this issue by first harvesting document metadata via a public search endpoint and subsequently fetching full rendered document contents using vulnerable block endpoints. This technical analysis explores the root cause, exploitation methodology, and remediation path.\n\n## TL;DR\nAn unauthenticated remote attacker can bypass password protection on published notes in SiYuan by retrieving block IDs through search metadata leaks and querying auxiliary block endpoints directly.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6\n- **EPSS Score**: Not available\n- **Impact**: High (Complete loss of confidentiality of protected documents)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan (Go Kernel Backend)\n- **SiYuan**: < 0.0.0-20260721020826-2d069dce84a2 (Fixed in: `0.0.0-20260721020826-2d069dce84a2`)\n\n## Mitigation\n\n- Upgrade to the latest patched version of SiYuan.\n- Deploy a reverse proxy (e.g., Nginx) to block external access to vulnerable auxiliary block API endpoints.\n- Limit access to the SiYuan publish-mode port (6808) to trusted networks or IP addresses.\n- Disable publish mode entirely if it is not required for daily operations.\n\n**Remediation Steps:**\n1. Identify all running instances of SiYuan in the environment.\n2. Verify the version of each instance by checking the kernel build metadata.\n3. Apply the patch by updating the container image or application binary to version 0.0.0-20260721020826-2d069dce84a2 or newer.\n4. If patching is delayed, update reverse proxy configurations to deny unauthenticated traffic to /api/block/getHeading routes.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-7j72-f6wg-cxw6)\n- [SiYuan Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j72-f6wg-cxw6)\n- [Fix Commit](https://github.com/siyuan-note/siyuan/commit/2d069dce84a25c959ef0093c72c98e05778ef218)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-68584)\n- [VulnCheck Threat Intelligence Advisory](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-content-endpoints)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T22:31:26.470700Z"} https://vulnerability.circl.lu/sighting/ef40026a-862a-476e-b210-47f6878e0e2d/export Thu, 03 Sep 2026 22:31:26 +0000 https://vulnerability.circl.lu/sighting/6d0161e2-0185-4c97-8808-448eb0502d22/export {"uuid": "6d0161e2-0185-4c97-8808-448eb0502d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u", "content": "CVE-2026-68584 - siyuan\nSiYuan versions before 3.7.3 have a security flaw that allows anyone to access documents that are supposed to be password-protected. This is because some parts of the system don't\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:56:05.016076Z"} {"uuid": "6d0161e2-0185-4c97-8808-448eb0502d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u", "content": "CVE-2026-68584 - siyuan\nSiYuan versions before 3.7.3 have a security flaw that allows anyone to access documents that are supposed to be password-protected. This is because some parts of the system don't\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:56:05.016076Z"} https://vulnerability.circl.lu/sighting/6d0161e2-0185-4c97-8808-448eb0502d22/export Mon, 03 Aug 2026 14:56:05 +0000