CVE-2026-72812: SiYuan: broken auth on refreshBacklink enables DoS

**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812). ### Summary The `/api/ref/refreshBacklink` endpoint is gated by `CheckAuth` only. Unlike its mutating siblings, it carries no `CheckAdminRole`, no `CheckReadonly`, and no inline reader-role guard so it falls through all three authorization mechanisms the codebase uses to protect write operations. A publish `RoleReader` or the anonymous account when `Publish.Auth.Enable` is `false` can invoke it, forcing the server to flush its pending write-transaction queue, scan all references globally, load and parse referencing trees from disk, and enqueue database writes. This violates the read-only invariant (it writes even in a globally read-only workspace), provides an unauthenticated resource-amplification/DoS primitive, and applies no per-object access check to the caller-supplied ID. ### Details **Route / auth tier.** `router.go`: `Handle("POST", "/api/ref/refreshBacklink", model.CheckAuth, refreshBacklink)`, `CheckAuth` only. `CheckAuth` admits `RoleReader`; the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous account when publish auth is disabled). Anonymous/reader reachable. **Guard fall-through.** SiYuan protects write handlers with one of three mechanisms: route-level `CheckAdminRole` (AV/riff/repo/sync/setting/snippet/notebook mutations), route-level `CheckReadonly` (filetree/block/attr/tag mutations), or an inline `IsReadOnlyRoleContext` check (e.g. `updateEmbedBlock`, `updateRecentDoc*Time`). `refreshBacklink` has none of the three. **Write path reached.** `refreshBacklink` calls `model.RefreshBacklink(id)`: - `FlushTxQueue()` — forces the pending write-transaction queue to disk. - `refreshRefsByDefID(defID)` → `QueryRefsByDefID(defID)` (global scan with encrypted-box fallback loop) → `filesys.LoadTrees(rootIDs)` (disk read and Lute parse of every referencing tree) → `sql.UpdateRefsTreeQueue(tree)` (enqueues DB writes) → ref-count task update. The handler also does not consult `util.ReadOnly`, so it executes its writes even when the workspace is configured globally read-only. **No per-object authorization.** `defID` is attacker-controlled and receives no publish-access or ownership check, so a reader can force a reference reindex of any document, including publish-forbidden/unpublished ones (cross-scope). ### Proof of Concept Reproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled), as an anonymous reader (no token): **Target endpoint executes the full write path:** ``` POST http://127.0.0.1:6808/api/ref/refreshBacklink {"id":"<any block id>"} ``` Returns `{"code":0,"msg":"","data":null}` HTTP 200 the handler ran to completion, flushing the transaction queue and enqueuing ref writes. **Controls: the guarded mutating siblings correctly reject the same anonymous session:** ``` POST http://127.0.0.1:6808/api/tag/renameTag → 403 (CheckAdminRole and CheckReadonly) POST http://127.0.0.1:6808/api/block/foldBlock → 403 POST http://127.0.0.1:6808/api/block/updateEmbedBlock → code 0 no-op (inline IsReadOnlyRoleContext blocks the write) ``` The 200-vs-403 contrast confirms `refreshBacklink` is reachable and executes where its siblings are blocked. ### Impact An anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can: - **Bypass the read-only invariant:** trigger persistent server-side writes (transaction-queue flush and reference reindex), including in a workspace configured globally read-only. - **Amplify resource use without authentication:** each call forces a transaction flush, a global reference scan, and disk read and parse of every referencing tree, with an attacker-controlled `id` and no rate limiting, a DoS primitive. - **Act cross-scope:** `defID` receives no publish-access check, so a reader can force reindexing of documents outside their publish scope. This is an integrity-invariant violation and a resource-amplification vector, not data corruption or injection, the caller cannot control the content of the writes, only trigger them. Impact is integrity-low and availability-low; no confidentiality impact and no attacker-controlled data reaches storage. ### Suggested fix Apply the same guard its mutating siblings use, add `CheckReadonly` (and `CheckAdminRole` if reference refresh is intended to be an authenticated operation) to the route, or an inline `IsReadOnlyRoleContext` check consistent with `updateEmbedBlock`. The endpoint should also honor `util.ReadOnly` and apply a publish-access check to `defID` so a reader cannot force cross-scope reindexing. More broadly, the three-way guard strategy (route middleware vs. inline check vs. none) is what allowed this handler to receive no gate at all; a structural backstop, a role-scoped route group for the mutation surface would prevent recurrence.

An organization runs SiYuan in publish mode to share a curated knowledge base externally (e.g., team wiki, documentation portal, or notes feeding an internal AI assistant), with publish Basic Auth left disabled for convenience. An attacker with no credentials sends repeated `POST /api/ref/refreshBacklink` requests with varying `id` values scraped from the publicly rendered pages. Each request forces the server to flush its write-transaction queue, scan all references, and load/parse referencing trees from disk — with no rate limit, a handful of concurrent scripted requests degrade response times for legitimate readers and, at scale, exhaust CPU/I/O on the host. Because the endpoint bypasses the workspace's read-only setting, this also silently mutates internal reference-count state even on instances explicitly configured as read-only, undermining any assumption that the published copy is immutable — relevant if that read-only guarantee was itself part of a data-integrity or compliance control.