Authentication Bypass Vulnerability in SiYuan Publish Mode

SiYuan versions prior to v3.7.3 contain a high-severity authentication bypass vulnerability affecting the software's 'publish mode'. While the primary document access endpoint ('getDoc') correctly implements password verification for protected content, other secondary endpoints - specifically 'getHeadingChildrenDOM', 'getHeadingTransaction', and 'getBacklinkDoc' - fail to perform the necessary authorization checks.

This vulnerability allows unauthenticated attackers to bypass password gates and exfiltrate the full content of protected documents. Attackers can leverage this by first obtaining internal block IDs from endpoints accessible to readers, and subsequently calling the unprotected endpoints to retrieve the actual sensitive content. Because the application logic relies on these secondary endpoints for metadata and backlink rendering, they are exposed to any visitor of the published site, leading to unauthorized data disclosure. Users are advised to upgrade to version 3.7.3 or later immediately to secure the publish mode infrastructure.

Impact

Successful exploitation results in the unauthorized exfiltration of sensitive, password-protected document content. Given the nature of SiYuan as a note-taking and knowledge management platform, the impact includes the potential exposure of proprietary research, intellectual property, or personal information hosted within these protected instances. There is no public record of the number of victims, but the vulnerability affects any deployment running an unpatched version of SiYuan with password-protected publishing enabled.

Recommendation

• Upgrade all instances of SiYuan to version 3.7.3 or later.
• Audit access logs for anomalous, repetitive calls to 'getHeadingChildrenDOM', 'getHeadingTransaction', or 'getBacklinkDoc' from external/unauthenticated source IPs.
• If upgrading is not immediately feasible, disable the publish mode feature to prevent unauthorized access to sensitive document data.