THREAT OPS › Threat News › [GHSA] GHSA-7j72-f6wg-cxw6 (high) — SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
[GHSA] GHSA-7j72-f6wg-cxw6 (high) — SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
GHSA-7j72-f6wg-cxw6 Severity: high CVE: None
SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)
**CVE:** This vulnerability corresponds to CVE-2026-68584.
### Summary
SiYuan's publish mode defines a "protected" access level: a document that is publicly lis
Indicators of compromise
- CVE-2026-68584cve
- http://127.0.0.1:6808/api/filetree/getDocurl
- http://127.0.0.1:6808/api/search/searchEmbedBlockurl
- http://127.0.0.1:6808/api/block/getHeadingChildrenDOMurl
Original source: https://github.com/advisories/GHSA-7j72-f6wg-cxw6