CVE-2026-72812 exposes a resource amplification vulnerability in SiYuan's /api/ref/refreshBacklink endpoint that merits immediate attention not for its individual impact, but for what it reveals about a repeating vulnerability genotype in your codebase.
The mechanics are specific: an unauthenticated caller provides any block ID, and the server performs a global reference scan across all documents, then enqueues database writes for each discovered backlink. There is no rate limiting, no cost estimation, no queue depth guard. One attacker triggering repeated requests creates transaction queue exhaustion that degrades performance for every concurrent user on the instance. This is not a classic single-user DoS — it's a system-wide destabilizer where the blast radius is diffuse and non-consumptive of the attacker's own resources.
The CVSS of 6.5 is misleading. The metric heavily weights exploitability, which is trivially easy here — no authentication, simple parameters, anonymous access. But the actual impact is multi-tenant: every user on a shared SiYuan instance feels the I/O storm from a single attacker's requests. The read-only protection bypass indicates that this endpoint predates or exists outside the current security layering review, which is the same failure mode seen in dozens of similar CVEs over two decades.
Your immediate priorities: First, verify whether refreshBacklink is actually necessary as an anonymous endpoint — if the refresh semantics can be moved behind authentication or scheduled as a background task, that eliminates the amplification vector entirely. Second, if the endpoint must remain, apply aggressive rate limiting per IP and per-session, and implement hard limits on the number of transactions that can be queued from a single request. Third, audit for other endpoints with global scan semantics and write amplification potential — this genotype rarely appears in isolation; where you find one, others exist nearby with the same internal-assumption blind spot.
The deeper question is whether your development process catches endpoints that predate current security practices. If refreshBacklink survived into production through attrition rather than deliberate exposure, the fix isn't just patching this route — it's establishing a systematic forgotten-code audit to catch the next one before it becomes the next CVE.