Security readout for executives and security teams
Plain-English summary
SiYuan installations before version 3.7.3 may expose restricted document content through three heading-related functions. An anonymous visitor or low-privilege publish reader could retrieve rendered content from documents whose publishing access is disabled, potentially disclosing sensitive notes without modifying systems.
Executive priority
Treat this as an urgent confidentiality issue. Patch internet-facing or sensitive-data deployments first, then investigate for unauthorized document retrieval. Immediate emergency response is justified where affected instances expose confidential business, customer, credential, or regulated information, although active exploitation has not been established.
Technical view
The getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints return rendered block DOM without enforcing publish-access checks. Supplying a heading block identifier can expose complete rendered content from publish-disabled documents. The issue is an authorization failure classified as CWE-862, with CVSS 4.0 score 9.2.
Likely exposure
Exposure is most likely on remotely reachable SiYuan deployments running versions earlier than 3.7.3, particularly where anonymous publishing or RoleReader tokens are available. Exploitation also requires a usable heading block ID; the sources do not establish how readily attackers can discover those identifiers.
Exploitation context
The vulnerability is remotely reachable, requires no privileged account or user interaction, and can cause high confidentiality impact. The supplied record says it is not in KEV, and the cited information provides no evidence of active exploitation. Public advisory availability may increase investigation and scanning interest.
Researcher notes
The security boundary failure is missing publish authorization before rendered block DOM is returned. Testing should remain limited to authorized environments and confirm behavior across anonymous and RoleReader contexts. The supplied sources identify affected versions and functions but do not establish identifier discoverability, exploitation prevalence, or observed attacks.
Mitigation direction
- Upgrade affected SiYuan installations to version 3.7.3 or later.
- Prioritize externally reachable instances and deployments containing confidential documents.
- Restrict public access to affected SiYuan services until upgrades are complete.
- Rotate exposed publish RoleReader tokens if unauthorized access is suspected.
- Review the vendor advisory for additional release-specific guidance.
Validation and detection
- Inventory all SiYuan instances and confirm their installed versions.
- Identify instances older than 3.7.3 that are reachable by untrusted users.
- Verify publish-disabled documents cannot be returned through the three affected endpoints.
- Review access logs for unexpected requests to the affected heading transaction endpoints.
- Assess potentially exposed documents and tokens if suspicious access is found.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-68587 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-69mh-gvh4-8gp7)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.3 Information Disclosure via getHeading*TransactionCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.