The critical vulnerability in CVE-2026-68586 is not the content disclosure — it is the reference-existence oracle that confirms relationships between publish-forbidden documents and known block IDs. In SiYuan, the list endpoints (getBacklinkDoc, getBackmentionDoc) correctly filter forbidden documents, but the content endpoints do not. An attacker who knows a document ID can query the content endpoint and receive a non-empty response confirming that the forbidden document references a specific block. That single bit — existence of a relationship — is the actual exploit. Knowing that forbidden-doc-X references block-Y reveals structural information about the knowledge graph even without the document's content.
This matters because the relationship topology is often more sensitive than the content itself. A forbidden document may be prohibited not for what it says, but for what it reveals about strategic thinking, competitive analysis, or personal annotations that become meaningful only in context of other documents. Confirming a link to block-Y tells an attacker where to probe next, and the next query confirms what else references block-Y — iterative graph reconstruction that the CVSS score entirely misses because it evaluates individual API calls, not the cascade.
The deployment configuration amplifies this: when Basic Auth is disabled, anonymous readers can exploit the oracle with no credentials at all, only valid-looking document IDs. Those IDs may be guessable or recoverable from published documents, making this closer to information disclosure through enumeration than credential theft.
The v3.7.3 patch closes the content endpoint bypass, but three unknowns should concern defenders. First, the patch appears to address these two endpoints specifically rather than the middleware layer that should compose authentication with the publish-filter — that pattern suggests other endpoints likely share the same partial-enforcement flaw. Second, the patch likely returns empty result sets for forbidden documents rather than rejecting the query, which means the oracle degrades but may not disappear: absence of references itself signals that a forbidden document occupies a peripheral node in the forbidden subgraph. Third, the exposure window predates the CVE by the lifetime of the publish-forbidden feature — if the server logs API requests, historical queries may already contain enumeration of forbidden relationships.
Prioritize auditing other API endpoints for the CheckAuth-without-publish-filter pattern, particularly any getForwardlink or reference-traversal functions. Treat the relationship graph as a first-class sensitivity class, not metadata — the permission model should protect linkage structure the same way it protects document content.