Listen to this Post
CVE-2026-72812 exposes a critical authorization flaw in SiYuan Note’s publish service.
The vulnerable endpoint is /api/ref/refreshBacklink, which is intended for refreshing reference indexes.
Unlike its mutating siblings, this endpoint only uses CheckAuth middleware.
It lacks CheckAdminRole, CheckReadonly, and any inline IsReadOnlyRoleContext guard.
This allows RoleReader users or anonymous accounts (when Publish.Auth.Enable is false) to trigger it.
The endpoint calls model.RefreshBacklink(id) which executes a full write path.
First, FlushTxQueue() forces pending write-transactions to disk.
Then refreshRefsByDefID(defID) performs a global scan of all references.
It uses QueryRefsByDefID to scan the entire database with encrypted-box fallback.
For each referencing tree, filesys.LoadTrees reads and parses them from disk.
Finally, sql.UpdateRefsTreeQueue enqueues database writes and updates ref counts.
The handler does not check util.ReadOnly, so it writes even in read-only mode.
There is no per-object authorization on the attacker-controlled defID parameter.
An attacker can force reindexing of any document, including unpublished ones.
This cross-scope action violates the integrity invariant of the workspace.
Since no rate limiting is applied, repeated calls cause resource exhaustion.
Each call triggers heavy disk I/O and transaction flushes, degrading performance.
This provides an unauthenticated DoS primitive against the server.
The vulnerability was reproduced with a simple POST request returning code 0.
Controlled mutating endpoints like /api/tag/renameTag correctly return 403.
The 200-vs-403 contrast confirms the authorization bypass is real.
Impact includes integrity-low and availability-low, no confidentiality impact.
The attacker cannot control write content, only trigger the reindex process.
However, the ability to trigger writes in a read-only workspace is a violation.
The suggested fix is to add CheckReadonly and CheckAdminRole to the route.
Alternatively, add an inline IsReadOnlyRoleContext check like updateEmbedBlock.
Also, honor util.ReadOnly and add a publish-access check for the defID.
A structural backstop with role-scoped route groups would prevent recurrence.
This vulnerability is categorized as medium severity due to limited impact.
Exploitation requires network access to the publish port (6808) and no authentication.
DailyCVE Form:
Platform: SiYuan Note
Version: All versions
Vulnerability: Auth Bypass
Severity: Medium
date: Sep 3 2026
Prediction: October 15 2026
What Undercode Say:
PoC – trigger the vulnerable endpoint
curl -X POST http://127.0.0.1:6808/api/ref/refreshBacklink -H “Content-Type: application/json” -d ‘{“id”:”
DoS amplification loop
while true; do curl -X POST http://127.0.0.1:6808/api/ref/refreshBacklink -H “Content-Type: application/json” -d ‘{“id”:”test”}’ ; done
Verify guarded endpoints return 403 for same session
curl -X POST http://127.0.0.1:6808/api/tag/renameTag -H “Content-Type: application/json” -d ‘{“oldTag”:”a”,”newTag”:”b”}’
curl -X POST http://127.0.0.1:6808/api/block/foldBlock -H “Content-Type: application/json” -d ‘{“id”:”
Exploit: (Educational Purposes!)
curl -X POST http://
Repeat the request in a loop to exhaust server resources and force persistent write flushes.
Protection: from this CVE
Add CheckReadonly and CheckAdminRole middleware to the route registration.
Alternatively, insert an inline IsReadOnlyRoleContext check before executing the handler.
Ensure the handler checks util.ReadOnly and aborts if true.
Implement per-object publish-access validation on the supplied defID.
Deploy rate limiting on /api/ref/refreshBacklink to prevent abuse.
Impact:
Bypass of the read‑only invariant, allowing writes in read‑only workspaces.
Unauthenticated resource amplification and denial of service via heavy disk I/O.
Cross‑scope reindexing of unpublished or forbidden documents.
Integrity‑low and availability‑low; no confidentiality loss or data injection.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
