The vulnerability occurs because the getBacklinkDoc and getBackmentionDoc content endpoints in SiYuan do not enforce publish-access filters, although their list endpoints do. This missing authorization check allows a publish-mode or even anonymous reader to request the rendered DOM content of any publish‑forbidden document by providing its ID to /api/ref/getBacklinkDoc or /api/ref/getBackmentionDoc. The result is a full content disclosure and an oracle that reveals whether the document references a specific block. This flaw is a classic missing authorization error (CWE‑862) that gives attackers access to confidential information.

SiYuan Note’s Siyuan application, versions before v3.7.3, is affected. The issue appears in all releases of Siyuan through 3.7.2 and is fixed in v3.7.3 and later.

The flaw carries a CVSS score of 9.2, indicating critical severity, and is not yet listed in CISA’s KEV catalog. Exploitation requires only network access to the API endpoints and the ability to authenticate as a publish-mode reader or remain anonymous when publish Basic Auth is disabled. Because the endpoint is guarded only by CheckAuth, an attacker can enumerate forbidden document IDs and pull their rendered content, achieving information disclosure with minimal effort.