CVE-2026-72812: SiYuan before v3.7.4 Missing Authorization via refreshBacklink
SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Configuration
Ensure /api/ref/refreshBacklink does not allow anonymous readers to trigger the refreshBacklink operation; require proper authorization so unauthenticated requests cannot cause persistent server-side writes.
SiYuan /api/ref/refreshBacklink Missing Authorization via refreshBacklink = requires authorization (no anonymous access)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72812?
CVE-2026-72812 has a medium severity rating of 6.5.
How do I fix CVE-2026-72812?
To fix CVE-2026-72812, upgrade SiYuan to version 3.7.4 or later to address the missing authorization vulnerability.
What vulnerability does CVE-2026-72812 expose?
CVE-2026-72812 exposes a missing authorization vulnerability that allows unauthorized access to the /api/ref/refreshBacklink endpoint.
Can CVE-2026-72812 lead to data loss?
Yes, CVE-2026-72812 can lead to persistent server-side writes that may result in data loss if exploited.
What versions of SiYuan are affected by CVE-2026-72812?
All versions of SiYuan prior to v3.7.4 are affected by CVE-2026-72812.