CVE-2026-72790

Deferred Deferred - Pending Action

SiYuan Information Disclosure via Unauthorized Notebook Metadata Access

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and timestamps for closed or non-published notebooks that should be hidden from readers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72790

EUVD

EUVD-2026-57450

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

SiYuan before v3.7.4 has an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint. This flaw allows unauthorized access to notebook metadata such as names, document counts, sizes, and timestamps even for closed or non-published notebooks that should remain hidden. The issue occurs because the endpoint lacks proper authorization checks.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before 3.7.4. Use commands like 'curl http://localhost:6806/api/notebook/getNotebookInfo' to test if the endpoint returns notebook metadata without proper authorization. If it does, the system is vulnerable.

Impact Analysis

Attackers could exploit this to view sensitive notebook details like names and document counts without authentication. This may reveal confidential workspace structure or activity to unauthorized users, potentially leading to further targeted attacks or data leaks.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive information without proper authorization. Unauthorized access to notebook metadata may lead to compliance breaches, especially if the exposed data includes personally identifiable or confidential information.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/notebook/getNotebookInfo endpoint via network controls or disable it if unused.

Hi! I’m here to help you understand CVE-2026-72790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70