{"id":"CVE-2026-72812","aliases":["EUVD-2026-58627","GHSA-wgwx-479j-23vq","GHSA-ww86-c2qf-w8fw","GO-2026-6408","SUSE-SU-2026:23855-1","SUSE-SU-2026:23863-1","openSUSE-SU-2026:21897-1"],"status":"published","title":"SiYuan before v3.7.4 Missing Authorization via refreshBacklink","description":"SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00377,"percentile":0.32173,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-08-14T11:35:25Z","modified":"2026-09-27T18:23:16Z","fixes":[{"ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","fixed_in":["0.0.0-20260723002528-7d273c271ce1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20260723002528-7d273c271ce1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260723002528-7d273c271ce1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260723002528-7d273c271ce1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20260916T180043-160000.1.1"}]}],"bundled":91}],"products":[{"vendor":"siyuan-note","product":"siyuan"}],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-wgwx-479j-23vq","tags":["vendor-advisory","web","advisory"]},{"url":"https://www.vulncheck.com/advisories/siyuan-before-missing-authorization-via-refreshbacklink","tags":["third-party-advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72812","tags":["advisory"]},{"url":"https://github.com/siyuan-note/siyuan/commit/7d273c271ce193b9d3ee5751b596b8093ba84ada","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wgwx-479j-23vq"},{"url":"https://github.com/advisories/GHSA-ww86-c2qf-w8fw"},{"url":"https://github.com/siyuan-note/siyuan","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623855-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-60004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68584","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-68587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69083","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-71494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-72921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73842","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-79921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-88046","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623863-1/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-72812","title":"SiYuan before v3.7.4 Missing Authorization via refreshBacklink","description":"SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","status":"published","published":"2026-08-14T11:35:25.455Z","modified":"2026-08-17T16:09:23.114Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:51.663093Z"}],"euvd":[{"id":"EUVD-2026-58627","description":"SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","status":"published","published":"2026-08-14T11:35:25Z","modified":"2026-08-17T16:09:23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:48.853514Z"}],"ghsa":[{"id":"GHSA-wgwx-479j-23vq","title":"SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)","description":"**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812).\n\n### Summary\n\nThe `/api/ref/refreshBacklink` endpoint is gated by `CheckAuth` only. Unlike its mutating siblings, it carries no `CheckAdminRole`, no `CheckReadonly`, and no inline reader-role guard so it falls through all three authorization mechanisms the codebase uses to protect write operations. A publish `RoleReader` or the anonymous account when `Publish.Auth.Enable` is `false` can invoke it, forcing the server to flush its pending write-transaction queue, scan all references globally, load and parse referencing trees from disk, and enqueue database writes. This violates the read-only invariant (it writes even in a globally read-only workspace), provides an unauthenticated resource-amplification/DoS primitive, and applies no per-object access check to the caller-supplied ID.\n\n### Details\n\n**Route / auth tier.** `router.go`: `Handle(\"POST\", \"/api/ref/refreshBacklink\", model.CheckAuth, refreshBacklink)`, `CheckAuth` only. `CheckAuth` admits `RoleReader`; the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous account when publish auth is disabled). Anonymous/reader reachable.\n\n**Guard fall-through.** SiYuan protects write handlers with one of three mechanisms: route-level `CheckAdminRole` (AV/riff/repo/sync/setting/snippet/notebook mutations), route-level `CheckReadonly` (filetree/block/attr/tag mutations), or an inline `IsReadOnlyRoleContext` check (e.g. `updateEmbedBlock`, `updateRecentDoc*Time`). `refreshBacklink` has none of the three.\n\n**Write path reached.** `refreshBacklink` calls `model.RefreshBacklink(id)`:\n- `FlushTxQueue()` — forces the pending write-transaction queue to disk.\n- `refreshRefsByDefID(defID)` → `QueryRefsByDefID(defID)` (global scan with encrypted-box fallback loop) → `filesys.LoadTrees(rootIDs)` (disk read and Lute parse of every referencing tree) → `sql.UpdateRefsTreeQueue(tree)` (enqueues DB writes) → ref-count task update.\n\nThe handler also does not consult `util.ReadOnly`, so it executes its writes even when the workspace is configured globally read-only.\n\n**No per-object authorization.** `defID` is attacker-controlled and receives no publish-access or ownership check, so a reader can force a reference reindex of any document, including publish-forbidden/unpublished ones (cross-scope).\n\n### Proof of Concept\n\nReproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled), as an anonymous reader (no token):\n\n**Target endpoint executes the full write path:**\n```\nPOST http://127.0.0.1:6808/api/ref/refreshBacklink\n{\"id\":\"\u003cany block id\u003e\"}\n```\nReturns `{\"code\":0,\"msg\":\"\",\"data\":null}` HTTP 200 the handler ran to completion, flushing the transaction queue and enqueuing ref writes.\n\n**Controls: the guarded mutating siblings correctly reject the same anonymous session:**\n```\nPOST http://127.0.0.1:6808/api/tag/renameTag      → 403 (CheckAdminRole and CheckReadonly)\nPOST http://127.0.0.1:6808/api/block/foldBlock    → 403\nPOST http://127.0.0.1:6808/api/block/updateEmbedBlock → code 0 no-op (inline IsReadOnlyRoleContext blocks the write)\n```\nThe 200-vs-403 contrast confirms `refreshBacklink` is reachable and executes where its siblings are blocked.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can:\n\n- **Bypass the read-only invariant:** trigger persistent server-side writes (transaction-queue flush and reference reindex), including in a workspace configured globally read-only.\n- **Amplify resource use without authentication:** each call forces a transaction flush, a global reference scan, and disk read and parse of every referencing tree, with an attacker-controlled `id` and no rate limiting, a DoS primitive.\n- **Act cross-scope:** `defID` receives no publish-access check, so a reader can force reindexing of documents outside their publish scope. This is an integrity-invariant violation and a resource-amplification vector, not data corruption or injection, the caller cannot control the content of the writes, only trigger them. Impact is integrity-low and availability-low; no confidentiality impact and no attacker-controlled data reaches storage.\n\n### Suggested fix\n\nApply the same guard its mutating siblings use, add `CheckReadonly` (and `CheckAdminRole` if reference refresh is intended to be an authenticated operation) to the route, or an inline `IsReadOnlyRoleContext` check consistent with `updateEmbedBlock`. The endpoint should also honor `util.ReadOnly` and apply a publish-access check to `defID` so a reader cannot force cross-scope reindexing. More broadly, the three-way guard strategy (route middleware vs. inline check vs. none) is what allowed this handler to receive no gate at all; a structural backstop, a role-scoped route group for the mutation surface would prevent recurrence.","status":"published","published":"2026-09-03T22:23:19Z","modified":"2026-09-03T22:23:20Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:12.487077Z"},{"id":"GHSA-ww86-c2qf-w8fw","title":"Duplicate Advisory: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wgwx-479j-23vq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","status":"withdrawn","published":"2026-08-14T12:31:24Z","modified":"2026-09-03T22:22:58Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:41:12.487077Z"}],"nvd":[{"id":"CVE-2026-72812","description":"SiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","status":"published","published":"2026-08-14T12:16:44.063Z","modified":"2026-08-26T16:57:52.167Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"GHSA-wgwx-479j-23vq","title":"SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)","description":"**CVE:** This vulnerability corresponds to [CVE-2026-72812](https://nvd.nist.gov/vuln/detail/CVE-2026-72812).\n\n### Summary\n\nThe `/api/ref/refreshBacklink` endpoint is gated by `CheckAuth` only. Unlike its mutating siblings, it carries no `CheckAdminRole`, no `CheckReadonly`, and no inline reader-role guard so it falls through all three authorization mechanisms the codebase uses to protect write operations. A publish `RoleReader` or the anonymous account when `Publish.Auth.Enable` is `false` can invoke it, forcing the server to flush its pending write-transaction queue, scan all references globally, load and parse referencing trees from disk, and enqueue database writes. This violates the read-only invariant (it writes even in a globally read-only workspace), provides an unauthenticated resource-amplification/DoS primitive, and applies no per-object access check to the caller-supplied ID.\n\n### Details\n\n**Route / auth tier.** `router.go`: `Handle(\"POST\", \"/api/ref/refreshBacklink\", model.CheckAuth, refreshBacklink)`, `CheckAuth` only. `CheckAuth` admits `RoleReader`; the publish proxy forwards port-6808 traffic with a Reader JWT (anonymous account when publish auth is disabled). Anonymous/reader reachable.\n\n**Guard fall-through.** SiYuan protects write handlers with one of three mechanisms: route-level `CheckAdminRole` (AV/riff/repo/sync/setting/snippet/notebook mutations), route-level `CheckReadonly` (filetree/block/attr/tag mutations), or an inline `IsReadOnlyRoleContext` check (e.g. `updateEmbedBlock`, `updateRecentDoc*Time`). `refreshBacklink` has none of the three.\n\n**Write path reached.** `refreshBacklink` calls `model.RefreshBacklink(id)`:\n- `FlushTxQueue()` — forces the pending write-transaction queue to disk.\n- `refreshRefsByDefID(defID)` → `QueryRefsByDefID(defID)` (global scan with encrypted-box fallback loop) → `filesys.LoadTrees(rootIDs)` (disk read and Lute parse of every referencing tree) → `sql.UpdateRefsTreeQueue(tree)` (enqueues DB writes) → ref-count task update.\n\nThe handler also does not consult `util.ReadOnly`, so it executes its writes even when the workspace is configured globally read-only.\n\n**No per-object authorization.** `defID` is attacker-controlled and receives no publish-access or ownership check, so a reader can force a reference reindex of any document, including publish-forbidden/unpublished ones (cross-scope).\n\n### Proof of Concept\n\nReproduced on a local instance (SiYuan running locally, publish mode enabled on port 6808, publish Basic Auth disabled), as an anonymous reader (no token):\n\n**Target endpoint executes the full write path:**\n```\nPOST http://127.0.0.1:6808/api/ref/refreshBacklink\n{\"id\":\"\u003cany block id\u003e\"}\n```\nReturns `{\"code\":0,\"msg\":\"\",\"data\":null}` HTTP 200 the handler ran to completion, flushing the transaction queue and enqueuing ref writes.\n\n**Controls: the guarded mutating siblings correctly reject the same anonymous session:**\n```\nPOST http://127.0.0.1:6808/api/tag/renameTag      → 403 (CheckAdminRole and CheckReadonly)\nPOST http://127.0.0.1:6808/api/block/foldBlock    → 403\nPOST http://127.0.0.1:6808/api/block/updateEmbedBlock → code 0 no-op (inline IsReadOnlyRoleContext blocks the write)\n```\nThe 200-vs-403 contrast confirms `refreshBacklink` is reachable and executes where its siblings are blocked.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can:\n\n- **Bypass the read-only invariant:** trigger persistent server-side writes (transaction-queue flush and reference reindex), including in a workspace configured globally read-only.\n- **Amplify resource use without authentication:** each call forces a transaction flush, a global reference scan, and disk read and parse of every referencing tree, with an attacker-controlled `id` and no rate limiting, a DoS primitive.\n- **Act cross-scope:** `defID` receives no publish-access check, so a reader can force reindexing of documents outside their publish scope. This is an integrity-invariant violation and a resource-amplification vector, not data corruption or injection, the caller cannot control the content of the writes, only trigger them. Impact is integrity-low and availability-low; no confidentiality impact and no attacker-controlled data reaches storage.\n\n### Suggested fix\n\nApply the same guard its mutating siblings use, add `CheckReadonly` (and `CheckAdminRole` if reference refresh is intended to be an authenticated operation) to the route, or an inline `IsReadOnlyRoleContext` check consistent with `updateEmbedBlock`. The endpoint should also honor `util.ReadOnly` and apply a publish-access check to `defID` so a reader cannot force cross-scope reindexing. More broadly, the three-way guard strategy (route middleware vs. inline check vs. none) is what allowed this handler to receive no gate at all; a structural backstop, a role-scoped route group for the mutation surface would prevent recurrence.","status":"published","published":"2026-09-03T22:23:19Z","modified":"2026-09-10T15:25:49.259335056Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"GHSA-ww86-c2qf-w8fw","title":"Duplicate Advisory: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-wgwx-479j-23vq. This link is maintained to preserve external references.\n\n## Original Description\nSiYuan versions before v3.7.4 contain a missing authorization vulnerability in the /api/ref/refreshBacklink endpoint that allows anonymous readers to trigger persistent server-side writes. Attackers can invoke the endpoint with an attacker-controlled block ID to flush transaction queues, scan all references globally, and enqueue database writes, bypassing read-only protections and enabling resource amplification attacks.","status":"withdrawn","published":"2026-08-14T12:31:24Z","modified":"2026-09-03T22:30:08.605499672Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"GO-2026-6408","title":"SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: Missing authorization on refreshBacklink allows anonymous readers to trigger persistent server-side writes and unauthenticated resource amplification (publish mode) in github.com/siyuan-note/siyuan/kernel","status":"published","published":"2026-09-10T14:48:42Z","modified":"2026-09-10T15:15:14.75748472Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"openSUSE-SU-2026:21897-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:36:27Z","modified":"2026-09-25T18:23:11.534555779Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23855-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:15.791415126Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23863-1","title":"Security update for govulncheck-vulndb","description":"This update for govulncheck-vulndb fixes the following issues:\n\nChanges for govulncheck-vulndb:\n\n- Update to version 0.0.20260916T180043 2026-09-16T18:00:43Z (jsc#PED-11136).\n\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2026-6348 CVE-2026-84304 GHSA-vp52-pcj8-j9qc\n * GO-2026-6356 CVE-2026-65959 GHSA-mhc4-g3wh-cw7m\n * GO-2026-6366 CVE-2026-61625 GHSA-8q3c-rjr9-xxrp\n * GO-2026-6372 CVE-2026-79921 GHSA-6c5v-hqjr-5xxp\n * GO-2026-6441 CVE-2026-84303 GHSA-qc2q-p7wx-3px3\n * GO-2026-6443 CVE-2026-84445 GHSA-2v4p-qf9q-27wj\n * GO-2026-6444 CVE-2026-53495 GHSA-7jxh-36q5-gcqv\n * GO-2026-6445 CVE-2025-58363 GHSA-c23q-fw86-9h5x\n * GO-2026-6446 CVE-2025-24978 GHSA-g8rh-fjm6-h2h9\n * GO-2026-6447 CVE-2025-24979 GHSA-pqqc-8v73-9gg2\n * GO-2026-6448 CVE-2026-59185 GHSA-cp3j-m783-3ph5\n * GO-2026-6449 GHSA-hxjg-93wc-h8p8\n * GO-2026-6450 CVE-2026-59172 GHSA-m835-3cm9-rggg\n * GO-2026-6451 CVE-2026-59157 GHSA-v25g-mvwr-f5fp\n * GO-2026-6452 CVE-2026-59162 GHSA-fx5j-qcqg-grpf\n * GO-2026-6453 CVE-2026-59161 GHSA-q5j5-6p94-4gwc\n * GO-2026-6454 CVE-2026-88012 GHSA-7ghq-v6jf-g56c\n * GO-2026-6455 CVE-2026-88011 GHSA-rf44-j88r-hh8c\n * GO-2026-6456 CVE-2026-88045 GHSA-2p48-j3qc-rx9f\n * GO-2026-6457 CVE-2026-88046 GHSA-38xv-hf3p-h7mq\n * GO-2026-6458 CVE-2026-88017 GHSA-c476-6w5q-jw77\n * GO-2026-6459 CVE-2026-88016 GHSA-f8g7-2xjc-7mfh\n * GO-2026-6460 CVE-2026-88044 GHSA-p569-5gjg-9cmj\n * GO-2026-6461 CVE-2026-88015 GHSA-p6m2-r3w9-mpxw\n * GO-2026-6462 CVE-2026-88018 GHSA-xwwr-4h3p-r22c\n * GO-2026-6463 CVE-2026-88013 GHSA-486v-q2wf-fp2r\n * GO-2026-6464 CVE-2026-88014 GHSA-66hp-wgxq-6f5q\n * GO-2026-6465 CVE-2026-88009 GHSA-f52w-8j3h-j724\n * GO-2026-6466 CVE-2026-88007 GHSA-qqjf-53cj-pwvv\n * GO-2026-6467 CVE-2026-88004 GHSA-v67p-phpq-fc8x\n * GO-2026-6468 CVE-2026-88008 GHSA-w4v4-9rw7-5326\n * GO-2026-6469 CVE-2026-56665 GHSA-v77h-2w3m-94hx\n * GO-2026-6470 CVE-2026-56666 GHSA-992q-9gwp-7r79\n * GO-2026-6473 CVE-2026-76081 GHSA-v859-c572-qh5p\n * GO-2026-6474 CVE-2026-56668 GHSA-vrh8-c9cm-wh8v\n- Update to version 0.0.20260910T144842 2026-09-10T14:48:42Z.\n * GO-2026-6302 GHSA-mf7q-r4rv-jv94\n * GO-2026-6343 CVE-2026-25782 GHSA-qm72-8prh-g92x\n * GO-2026-6344 CVE-2026-26292 GHSA-rc56-rj3f-xggf\n * GO-2026-6345 CVE-2026-27779 GHSA-v8f2-2ghq-9whv\n * GO-2026-6346 CVE-2026-27780 GHSA-vhq7-fwwh-7hjf\n * GO-2026-6347 CVE-2026-27660 GHSA-x92v-f5gc-r34v\n * GO-2026-6350 CVE-2026-59832 GHSA-275h-v5h9-vr82\n * GO-2026-6351 CVE-2026-72920 GHSA-2v6v-25fm-p4fg\n * GO-2026-6353 CVE-2026-59834 GHSA-h89q-4j2h-7h88\n * GO-2026-6357 CVE-2026-73667 GHSA-2mw5-23gm-pccq\n * GO-2026-6358 CVE-2026-73841 GHSA-52gf-6rpq-fgmx\n * GO-2026-6359 CVE-2026-67446 GHSA-75mr-qw9x-3r39\n * GO-2026-6360 CVE-2026-73840 GHSA-c5f6-2rm9-2w8g\n * GO-2026-6361 CVE-2026-72921 GHSA-gv5w-hfx8-8cwq\n * GO-2026-6362 CVE-2026-73843 GHSA-qh9r-j7rp-4x2m\n * GO-2026-6363 CVE-2026-67445 GHSA-w878-pj84-3j5v\n * GO-2026-6364 GHSA-99rq-75j6-5j9f\n * GO-2026-6365 GHSA-gw25-m53r-qh88\n * GO-2026-6367 CVE-2026-56743 GHSA-fm8w-2m5w-9j7r\n * GO-2026-6368 CVE-2026-75602 GHSA-h6cj-26g5-67fv\n * GO-2026-6369 CVE-2026-73232 GHSA-jcvh-xf52-2cwm\n * GO-2026-6370 CVE-2026-73292 GHSA-8cj9-r88m-8945\n * GO-2026-6371 CVE-2026-73293 GHSA-cxvf-gvfq-36w2\n * GO-2026-6373 CVE-2026-69086 GHSA-7hm9-v7vf-7g4w\n * GO-2026-6374 CVE-2026-69083 GHSA-fph3-ghq9-vw66\n * GO-2026-6377 CVE-2026-69084 GHSA-vh22-h7hf-www7\n * GO-2026-6379 CVE-2026-68586 GHSA-36v8-mpjm-8j5r\n * GO-2026-6381 CVE-2026-68587 GHSA-69mh-gvh4-8gp7\n * GO-2026-6382 CVE-2026-68584 GHSA-7j72-f6wg-cxw6\n * GO-2026-6384 CVE-2026-68585 GHSA-pm3w-vxp9-ccwc\n * GO-2026-6386 CVE-2026-72809 GHSA-3mp7-4rh5-jrv9\n * GO-2026-6387 CVE-2026-72805 GHSA-67x2-mq63-v9vm\n * GO-2026-6388 CVE-2026-72806 GHSA-6mcf-g667-w3qv\n * GO-2026-6392 CVE-2026-72801 GHSA-8x84-r2ff-h8pq\n * GO-2026-6395 CVE-2026-72800 GHSA-5fhr-f75j-8wr9\n * GO-2026-6398 CVE-2026-72802 GHSA-jv8v-xq2h-657v\n * GO-2026-6400 CVE-2026-72810 GHSA-mw8r-mw84-88v2\n * GO-2026-6402 CVE-2026-72811 GHSA-q2vg-7qgx-x5fc\n * GO-2026-6404 CVE-2026-72803 GHSA-qvq9-hq6p-v378\n * GO-2026-6406 CVE-2026-72808 GHSA-v7ph-r5r6-4jcj\n * GO-2026-6407 CVE-2026-72804 GHSA-vpjw-wf5h-cgpq\n * GO-2026-6408 CVE-2026-72812 GHSA-wgwx-479j-23vq\n * GO-2026-6410 CVE-2026-72807 GHSA-x67c-8pwr-m8g3\n * GO-2026-6411 CVE-2026-11720 GHSA-vwxw-jrg6-9jxv\n * GO-2026-6412 CVE-2026-72799 GHSA-5w7r-f4cg-rqq7\n * GO-2026-6414 CVE-2026-72797 GHSA-f2rw-w22v-54vh\n * GO-2026-6415 CVE-2026-72798 GHSA-mfrj-v65r-979c\n * GO-2026-6420 CVE-2026-72794 GHSA-34fj-mwm6-fjfg\n * GO-2026-6423 CVE-2026-72796 GHSA-fgmr-7w36-9qfq\n * GO-2026-6424 CVE-2026-72793 GHSA-h4v5-crx2-3cv4\n * GO-2026-6425 CVE-2026-72795 GHSA-h6w7-xxcf-w2mq\n * GO-2026-6427 CVE-2026-72792 GHSA-mp7r-57w4-5qm3\n * GO-2026-6428 CVE-2026-73842 GHSA-rh53-xvx2-j327\n * GO-2026-6430 GHSA-57v5-wqx3-cgj4\n * GO-2026-6431 CVE-2026-72790 GHSA-74pj-6g7r-j55c\n * GO-2026-6433 CVE-2026-60004 GHSA-rcr6-4jqh-j84m\n * GO-2026-6434 CVE-2026-72789 GHSA-v684-q882-jgmq\n * GO-2026-6435 CVE-2026-73294 GHSA-xp7j-h7jc-4w8p\n * GO-2026-6437 CVE-2026-71494 GHSA-6x6c-w9w9-hv4h\n * GO-2026-6439 CVE-2026-71493 GHSA-mmg6-4qmv-6pc8\n * GO-2026-6440 CVE-2026-73087 GHSA-p2w3-6x73-2f6x\n","status":"published","published":"2026-09-21T12:24:57Z","modified":"2026-09-27T18:23:16.587575494Z","updated_at":"2026-11-02T15:54:03.991985Z"}]}}