{"vulnerability": "cve-2026-6858", "sightings": [{"uuid": "4df34c4c-e382-4936-bb3b-d4b075d924e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "published-proof-of-concept", "source": "https://t.me/bdufstecru/3360", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c RDP-\u043a\u043b\u0438\u0435\u043d\u0442\u0430 FreeRDP \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\nBDU:2026-10946\nCVE-2026-68580\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x", "creation_timestamp": "2026-08-04T07:00:04.495289Z"}, {"uuid": "8db12ba9-7c02-4a57-8a95-bf57ea18e48d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msaphjc77p2m", "content": "CVE-2026-68580 - freerdp2\nA vulnerability in Debian Linux allows an attacker to execute malicious code on a system without needing a password. This can happen if a user visits a compromised website\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#freerdp2 #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-04T09:34:03.377198Z"}, {"uuid": "dc23a060-de27-476d-8b5a-0e187f22aa6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms5os4fv2v2m", "content": "CVE-2026-68580\nFreeRDP versions before 3.29.0 contain a vulnerability that can cause a heap overflow when processing audio input from a remote server. This can potentially allow an attacker to crash the system or execute\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-03T04:44:06.098703Z"}, {"uuid": "6d0161e2-0185-4c97-8808-448eb0502d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyg64yp2u", "content": "CVE-2026-68584 - siyuan\nSiYuan versions before 3.7.3 have a security flaw that allows anyone to access documents that are supposed to be password-protected. This is because some parts of the system don't\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:56:05.016076Z"}, {"uuid": "62c4d54d-c8e0-4fef-8d97-2cb2d981e526", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68586", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6qyhkwq72o", "content": "CVE-2026-68586 - siyuan\nSiYuan before version 3.7.3 has a security weakness that allows anyone to see the content of documents they shouldn't have access to. This could be a problem if you have sensitive\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:56:06.516862Z"}, {"uuid": "6283bbfd-0d3f-45fd-bee5-ccef12e577cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68587", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms6r3yur7p2b", "content": "CVE-2026-68587 - siyuan\nSiYuan versions before 3.7.3 allow unauthorized users to view restricted content from published documents. This could allow malicious users to access sensitive information. Update\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-03T14:58:05.271908Z"}, {"uuid": "c0e8132c-8ff1-4991-bfd8-f3bce6672ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-68582", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117026155660414417", "content": "CVE-2026-68582 (CRITICAL): go-vikunja vikunja \u22642.3.0 allows attackers with a share link to read kanban bucket titles & user info from other tenants due to broken object auth at /projects/{project}/views/{view}/tasks. Update to 2.4.0+! https://radar.offseq.com/threat/cve-2026-68582-authorization-bypass-through-user-controlled-key-in-go-vikunja-vikunja-b2e26579de3aa2bc #OffSeq #CVE202668582 #Vulnerability", "creation_timestamp": "2026-08-02T13:30:24.696089Z"}, {"uuid": "4b103f7f-1d47-4a9e-99bf-7343a1950aaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ms45imklnk2n", "content": "\ud83d\udfe0 CVE-2026-68580 - High (7.5)\n\nFreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection ch...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-68580/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T14:01:54.451506Z"}, {"uuid": "7a9d79f3-0cfb-4270-b938-af4124a4ee61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3ms4675yian23", "content": "\ud83d\udfe0 CVE-2026-68580 - High (7.5)\n\nFreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection ch...\n\nhttps://www.themasherwire.com/vulnerability/CVE-2026-68580/\n\n#infosec #potatosecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-02T14:14:32.419437Z"}, {"uuid": "c622e950-6919-483c-b283-4c8f1e3c3483", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68582", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3ms4cglffdo24", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-68582 \u0432 Vikunja: \u043a\u0430\u043a \u0441\u043b\u043e\u043c\u0430\u043d\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439\n\n\n\nhttps://kripta.biz/posts/0DF06063-496A-45B6-82E0-A1F8A47ECBF5", "creation_timestamp": "2026-08-02T15:30:14.386146Z"}, {"uuid": "732a5438-5252-4831-9a82-375dcb8bf643", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68580", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mschvjpeov2o", "content": "CVE-2026-68580 - freerdp2\nFreeRDP versions before 3.29.0 have a security risk related to audio input redirection. An attacker could send a malicious audio request to a FreeRDP server,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#freerdp2 #canonical #Ubuntu1604LTS #CVE #infosec", "creation_timestamp": "2026-08-05T02:24:03.020327Z"}, {"uuid": "1f0e7e71-5a8b-48d2-9176-4d4174cb4183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6858", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mouftqsagb2s", "content": "CVE-2026-6858 - Transbank Webpay\nCVE ID : CVE-2026-6858\n \n Published : June 22, 2026, 6 a.m. | 1\u00a0hour, 43\u00a0minutes ago\n \n Description : The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perfo...", "creation_timestamp": "2026-06-22T07:54:24.877370Z"}, {"uuid": "ef40026a-862a-476e-b210-47f6878e0e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68584", "type": "seen", "source": "https://gist.github.com/alon710/4d2d0e14cc9fbf8c2c4ec8fd41b0edff", "content": "# GHSA-7J72-F6WG-CXW6: CVE-2026-68584: Authentication Bypass via Auxiliary Content Endpoints in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6\n\n## Summary\nAn authentication bypass vulnerability (classified as CWE-288) exists in the publish-mode component of SiYuan, a Go-based note-taking application. This security flaw allows unauthenticated remote attackers to bypass password-protected note boundaries by leveraging auxiliary block endpoints that fail to enforce document access checks. Attackers can exploit this issue by first harvesting document metadata via a public search endpoint and subsequently fetching full rendered document contents using vulnerable block endpoints. This technical analysis explores the root cause, exploitation methodology, and remediation path.\n\n## TL;DR\nAn unauthenticated remote attacker can bypass password protection on published notes in SiYuan by retrieving block IDs through search metadata leaks and querying auxiliary block endpoints directly.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-288 (Authentication Bypass Using an Alternate Path or Channel)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6\n- **EPSS Score**: Not available\n- **Impact**: High (Complete loss of confidentiality of protected documents)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan (Go Kernel Backend)\n- **SiYuan**: < 0.0.0-20260721020826-2d069dce84a2 (Fixed in: `0.0.0-20260721020826-2d069dce84a2`)\n\n## Mitigation\n\n- Upgrade to the latest patched version of SiYuan.\n- Deploy a reverse proxy (e.g., Nginx) to block external access to vulnerable auxiliary block API endpoints.\n- Limit access to the SiYuan publish-mode port (6808) to trusted networks or IP addresses.\n- Disable publish mode entirely if it is not required for daily operations.\n\n**Remediation Steps:**\n1. Identify all running instances of SiYuan in the environment.\n2. Verify the version of each instance by checking the kernel build metadata.\n3. Apply the patch by updating the container image or application binary to version 0.0.0-20260721020826-2d069dce84a2 or newer.\n4. If patching is delayed, update reverse proxy configurations to deny unauthenticated traffic to /api/block/getHeading routes.\n\n## References\n\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-7j72-f6wg-cxw6)\n- [SiYuan Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7j72-f6wg-cxw6)\n- [Fix Commit](https://github.com/siyuan-note/siyuan/commit/2d069dce84a25c959ef0093c72c98e05778ef218)\n- [NVD CVE Details](https://nvd.nist.gov/vuln/detail/CVE-2026-68584)\n- [VulnCheck Threat Intelligence Advisory](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-content-endpoints)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-7J72-F6WG-CXW6) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T22:31:26.470700Z"}, {"uuid": "a836698d-839e-4ed6-897c-360798c8168d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68587", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-69mh-gvh4-8gp7", "content": "", "creation_timestamp": "2026-09-03T22:35:07.383766Z"}, {"uuid": "62b41ca5-2a84-41eb-99a5-ddd1b1e38a36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68585", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-pm3w-vxp9-ccwc", "content": "", "creation_timestamp": "2026-09-03T22:35:03.044072Z"}, {"uuid": "8ac2fc48-744e-4ac7-a3a2-3ef0c8ed6196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68586", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-36v8-mpjm-8j5r", "content": "", "creation_timestamp": "2026-09-03T22:35:05.211907Z"}, {"uuid": "44e825d1-3e63-440a-87b8-3ddc73cbf2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68585", "type": "seen", "source": "https://gist.github.com/alon710/0a73f204f4113f41e2621c39634bb023", "content": "# CVE-2026-68585: CVE-2026-68585: Metadata Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68585\n\n## Summary\nA metadata disclosure vulnerability exists in SiYuan prior to version v3.7.3. The /api/block/getBlockInfo endpoint fails to validate authorization boundaries in publish mode, allowing anonymous readers to access private document metadata.\n\n## TL;DR\nUnauthenticated remote attackers can bypass authorization controls to exfiltrate private document metadata in SiYuan knowledge management servers by sending crafted API requests to /api/block/getBlockInfo.\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.8\n- **EPSS Score**: 0.00194 (Percentile: 9.16%)\n- **Impact**: Information Disclosure (Metadata Leakage)\n- **Exploit Status**: None / No Public PoC\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < v3.7.3 (Fixed in: `v3.7.3`)\n\n## Mitigation\n\n- Upgrade to SiYuan v3.7.3 or later\n- Disable public publish mode to prevent unauthenticated access\n- Implement reverse proxy rules to block /api/block/getBlockInfo for external users\n\n**Remediation Steps:**\n1. Identify running SiYuan instances and verify their versions.\n2. Download and apply the upgrade package for version v3.7.3 or higher.\n3. If immediate upgrade is not possible, disable public publishing inside settings.\n4. Verify endpoint restriction by attempting anonymous API requests to the patched endpoints.\n\n## References\n\n- [GitHub Security Advisory GHSA-pm3w-vxp9-ccwc](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-pm3w-vxp9-ccwc)\n- [VulnCheck Technical Advisory](https://www.vulncheck.com/advisories/siyuan-before-metadata-disclosure-via-getblockinfo)\n- [NVD Vulnerability Detail - CVE-2026-68585](https://nvd.nist.gov/vuln/detail/CVE-2026-68585)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68585) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T13:04:27.722209Z"}, {"uuid": "41b317f9-cac6-445b-b4f9-dcf85e901ba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68586", "type": "seen", "source": "https://gist.github.com/alon710/20f1059adcde1e4a5f6beaa48bfa0228", "content": "# CVE-2026-68586: CVE-2026-68586: Missing Authorization in SiYuan Backlink Content Endpoints Allows Information Disclosure\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68586\n\n## Summary\nSiYuan is a privacy-first personal knowledge management system. In versions prior to v3.7.3, the application fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints correctly filter out publish-forbidden documents, the content endpoints, which are only gated by high-level route authorization checks via CheckAuth, do not. Consequently, a user with low-privilege read access, or an anonymous reader when publish Basic Auth is disabled, can directly invoke these endpoints using a known publish-forbidden document's ID to retrieve its rendered DOM content or determine whether it references a specific target block.\n\n## TL;DR\nAn authorization bypass flaw in SiYuan's reference content retrieval API endpoints allows unauthorized readers to fetch the fully rendered DOM of publish-restricted documents using known document identifiers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (Remote)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **CVSS v3.1 Score**: 8.6 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v3.7.3\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.3 (Fixed in: `3.7.3`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.3 or higher.\n- Enable Publish Basic Authentication to restrict access to authorized readers only.\n- Disable the web publishing feature entirely if public note access is not required.\n- Deploy reverse proxy rules or WAF policies to monitor and filter traffic to the affected API endpoints.\n\n**Remediation Steps:**\n1. Identify all running instances of SiYuan in the environment.\n2. Verify the currently installed version using the system settings or by querying the version metadata.\n3. If the version is prior to 3.7.3, download the latest release from the official repository or update the Docker container image.\n4. Apply the update and restart the service.\n5. Configure basic authentication under the publish settings if public note hosting must remain active.\n6. Verify remediation by attempting to query the /api/ref/getBacklinkDoc endpoint as an unauthenticated reader.\n\n## References\n\n- [GitHub Security Advisory GHSA-36v8-mpjm-8j5r](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-36v8-mpjm-8j5r)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-content-disclosure-via-getbacklinkdoc)\n- [SiYuan Fix Commit](https://github.com/siyuan-note/siyuan/commit/f45749a7ef6e385f6e2af6b7dd12429d56d46f32)\n- [NVD CVE Detail Link](https://nvd.nist.gov/vuln/detail/CVE-2026-68586)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-68586)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68586) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T14:31:53.055495Z"}, {"uuid": "212e5998-f8ef-4f85-b8a8-372c27dda8b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68587", "type": "seen", "source": "https://gist.github.com/alon710/9e58c194a5866f9cf4591587a2bfc382", "content": "# CVE-2026-68587: CVE-2026-68587: Broken Access Control in SiYuan Note Transaction Endpoints\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68587\n\n## Summary\nCVE-2026-68587 is a critical authorization bypass vulnerability in SiYuan, an open-source personal knowledge management workspace. When deployed in publish mode, specific transaction endpoints fail to perform administrative role validation. This omission enables unauthenticated remote readers to retrieve the rendered Document Object Model (DOM) of publish-disabled (private) documents by supplying a target heading block identifier. Upgrading to version v3.7.3 or later resolves this issue by applying appropriate routing middleware constraints.\n\n## TL;DR\nAn unauthenticated remote information disclosure vulnerability exists in SiYuan Note versions prior to v3.7.3. Due to missing authorization checks in the heading transaction endpoints, an attacker can access the rendered content of private documents by targeting their block IDs. The vulnerability has been resolved by enforcing administrative authorization checks on the affected API routes.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Vulnerability Type**: Missing Authorization\n- **CVSS v4.0 Score**: 9.2\n- **Attack Vector**: Network\n- **Exploit Maturity**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note\n- **siyuan**: < v3.7.3 (Fixed in: `v3.7.3`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.3 or later\n- Disable Publish Mode if public reading access is not required\n- Deploy reverse proxy or WAF rules to restrict access to affected transaction endpoints\n\n**Remediation Steps:**\n1. Identify the version of SiYuan Note currently running in the environment\n2. Obtain version v3.7.3 or a newer release from the official repository\n3. Apply the update according to the deployment guidelines (Docker, local package, or server binaries)\n4. If immediate patching is impossible, modify your Nginx, Apache, or WAF configuration to block external access to `/api/block/getHeadingLevelTransaction`, `/api/block/getHeadingDeleteTransaction`, and `/api/block/getHeadingInsertTransaction`\n5. Verify the remediation by sending a test request to the transaction endpoints and ensuring a 403 Forbidden response is returned\n\n## References\n\n- [GitHub Security Advisory GHSA-69mh-gvh4-8gp7](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-69mh-gvh4-8gp7)\n- [Fix Commit 69db783](https://github.com/siyuan-note/siyuan/commit/69db783b782aea865ea70a1c5ab656e5c0f3dadb)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getheading-transaction)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-68587)\n- [NVD Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-68587)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68587) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T15:31:59.378706Z"}, {"uuid": "6e3441b4-96ee-4b96-9b79-fe76e16e0df4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68584", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-7j72-f6wg-cxw6", "content": "", "creation_timestamp": "2026-09-08T20:35:24.764828Z"}, {"uuid": "52267318-0bbb-428e-b9cc-a6f312469d96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68582", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-rj9j-8772-4h6c", "content": "", "creation_timestamp": "2026-10-09T20:42:33.000000Z"}, {"uuid": "97de9247-7231-4595-8382-118fdc974417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68581", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-vvcv-vpph-h844", "content": "", "creation_timestamp": "2026-10-09T20:42:14.000000Z"}]}