Description

SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T12:16:44.063Z",
  "pubdate": "2026-08-14T12:16:44.063Z",
  "executiveSummary": "SiYuan versions before v3.7.4 contain a missing authorization vulnerability located within the /api/ref/refreshBacklink endpoint. This security flaw enables anonymous, unauthenticated remote readers to bypass established read-only access controls and trigger persistent server-side writes. The primary impact includes forced transaction queue flushing, global reference scanning, and the unauthorized enqueuing of database write operations, facilitating resource amplification attacks. The vulnerability exposes the underlying application logic to unvalidated external inputs, directly violating fundamental access control boundaries and threatening data integrity as well as service availability.",
  "technicalDetails": "The vulnerability stems from an absolute absence of access control validation within the /api/ref/refreshBacklink endpoint handler in SiYuan prior to version v3.7.4. The affected component fails to enforce authentication checks or verify whether the requesting entity possesses the necessary administrative or write privileges before processing the incoming HTTP request. Consequently, an anonymous network attacker can interact directly with the vulnerable API route without supplying valid credentials or session tokens.\nThe exploitation method relies on supplying an attacker-controlled block ID parameter during the invocation of the /api/ref/refreshBacklink endpoint. When processed by the server, this malicious input forces the application backend to flush active transaction queues prematurely. Furthermore, the logic triggers a comprehensive, global scan of all stored references and automatically enqueues subsequent database write operations based on the manipulated context.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker crafts an HTTP request targeting the exposed /api/ref/refreshBacklink endpoint, embedding a specifically crafted or arbitrary block ID. Second, the vulnerable application accepts the request without validating the caller's session or authorization level. Third, the internal backend routine processes the parameter, initiating global reference lookups and interrupting normal transactional integrity. Finally, the application executes unauthorized database writes, consuming significant computational and I/O resources.\nThis behavior facilitates a resource amplification attack, wherein a minimal network request from an anonymous remote user forces the server to execute expensive database queries and write operations. The post-exploitation impact includes persistent database modification, potential degradation of service performance due to resource exhaustion, and circumvention of designated read-only deployment protections."
}