CVE-2026-72792

Received Received - Intake

SiYuan Information Disclosure via Unauthenticated Tag Endpoint

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-72792

EUVD

EUVD-2026-57452

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure flaw in SiYuan before version 3.7.4. The /api/tag/getTag endpoint exposes tag labels and occurrence counts from password-protected documents to unauthenticated users. The issue occurs because the endpoint uses a visibility filter that checks document visibility but ignores password protection, allowing unauthorized access to sensitive internal terminology.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance exposes tag labels from password-protected documents via the /api/tag/getTag endpoint. Use curl to query the endpoint without authentication and inspect responses for tag data from protected documents. Example: curl http://<target-ip>:<port>/api/tag/getTag

Verify if the endpoint returns tag labels and occurrence counts from documents that should require a password. Compare responses between authenticated and unauthenticated requests.

Impact Analysis

Attackers could enumerate internal terminology, tag vocabulary, or other sensitive data from password-protected documents without authentication. This may reveal confidential information such as project names, subjects, or organizational details, potentially leading to further targeted attacks or data leaks.

Compliance Impact

This vulnerability could violate compliance requirements by exposing sensitive data from protected documents. GDPR may require breach notification if personal data is disclosed, while HIPAA could be impacted if protected health information is exposed. Organizations using SiYuan must assess potential data exposure risks.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to apply the password-aware filter fix for the /api/tag/getTag endpoint.

Audit all visibility-only filters in the application to ensure password checks are implemented consistently across endpoints.

Restrict network access to the SiYuan instance if possible, limiting exposure to trusted users only.

Hi! I’m here to help you understand CVE-2026-72792. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70