H3-2026-1047¶
SiYuan Note Publish Backlink Document Access Bypass Vulnerability
| Category | VULNERABILITY |
| Base Score | 5.3 |
Description¶
B3log SiYuan Note contains an access control bypass in the getBacklinkDoc and getBackmentionDoc API endpoints within the publish service. These endpoints fail to enforce publish access restrictions, allowing requests to retrieve document content without verifying whether the target document is hidden, publish-disabled, or password-protected. The root cause is a missing authorization check (CWE-862) that should consult the publish access control mechanism before returning backlink content. Exploitation requires network access to a SiYuan instance with the publish service enabled and at least one published document containing backlink references to restricted documents.
Impact¶
Remote attackers can read the full content of password-protected or hidden documents through backlink references. This completely bypasses the publish access control mechanism designed to protect sensitive content. Organizations using SiYuan for internal knowledge management with selective publishing are at risk of unintended data exposure.