Vulnerability in github.com/siyuan-note/siyuan/kernel (CVE-2026-68585)
Summary
Vulnerability in github.com/siyuan-note/siyuan/kernel (CVE-2026-68585). Risk of unauthorized operations or information disclosure. Exploitable via rootTitle. Mitigation: upgrade to 0.0.0-20260721014951-ffde3b21eca4 or later.
Original description
The description as published by the source.
CVE: This vulnerability corresponds to CVE-2026-68585.
Summary
The /api/block/getBlockInfo endpoint returns document root metadata including the document title (rootTitle) for a block in a publish-forbidden document, with no publish-access check. Its sibling /api/block/getDocInfo applies the publish-access filter, getBlockInfo does not. Both are gated by CheckAuth only, so getBlockInfo is reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
Details
The list/info side of this API is filtered while the block-info twin is not the asymmetry indicates an oversight rather than intended behavior:
| Endpoint | Returns | Publish-access filter | Route |
|---|---|---|---|
getDocInfo |
document info/metadata | present | CheckAuth |
getBlockInfo |
box, path, rootID, rootTitle, rootChildID, rootIcon |
none | CheckAuth |
getBlockInfo takes a caller-supplied block ID, validates only its format, and returns the containing document's root metadata including rootTitle (the document title) with no IsReadOnlyRoleContext / publish-access check. Because getDocInfo performs the filtering for equivalent data, the boundary is clearly meant to apply here; getBlockInfo omits it.
Proof of Concept
Reproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled). Setup: a publish-forbi…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-68585 has been found in github.com/siyuan-note/siyuan/kernel.
Attackers can target a specific entry point like rootTitle over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 5.8/10.
What to do: upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260721014951-ffde3b21eca4 or later.
If unsure, ask your IT team or search "github.com/siyuan-note/siyuan/kernel CVE-2026-68585" on the vendor's site.
CVE-2026-68585 (github.com/siyuan-note/siyuan/kernel) — CWE-862 / CVSS v3 5.8
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: rootTitle / getBlockInfo / CheckAuth / RoleReader
Patched: 0.0.0-20260721014951-ffde3b21eca4 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-862) exists in github.com/siyuan-note/siyuan/kernel. Attackers reach the vulnerable code path via rootTitle without authentication.
Check the vendor advisory for the affected versions of github.com/siyuan-note/siyuan/kernel. Attack surface: rootTitle / getBlockInfo / CheckAuth / RoleReader.
Severity: Medium (CVSS 5.8/10). Risk of unauthorized operations or information disclosure.
Update to 0.0.0-20260721014951-ffde3b21eca4.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/siyuan-note/siyuan/kernel' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/siyuan-note/siyuan/kernel' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/siyuan-note/siyuan/kernelを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260721014951-ffde3b21eca4ステージング環境で 0.0.0-20260721014951-ffde3b21eca4 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web nvd.nist.gov
- web vulncheck.com
- web github.com
- web github.com
- web github.com