SiYuan Static-File Route Access Control Bypass

Executive Summary

CVE-2026-72796 is an access control bypass vulnerability in SiYuan before v3.7.4. Static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifacts by directly accessing static routes that lack the same restrictions as their REST API counterparts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SiYuan instance (version before 3.7.4) allows unauthorized access to static routes like /templates/, /snippets/, /widgets/, /plugins/, /emojis/, or /export/. Test by accessing these paths directly via curl or browser while authenticated as a reader or anonymous user. Example: curl http://localhost:6806/templates/ or curl http://localhost:6806/export/artifacts.pdf

Verify if sensitive data like templates or export artifacts are exposed without proper authorization checks. Compare responses from static routes against REST API endpoints for the same resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to access sensitive data such as templates, snippets, and export artifacts. Attackers with minimal access (like publish reader tokens) can bypass restrictions and retrieve confidential information without elevated privileges or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA due to unauthorized access to sensitive data. Under GDPR, unauthorized access to personal data may constitute a breach requiring notification to authorities and affected individuals. For HIPAA, exposure of protected health information through unauthorized access could violate privacy rules. The flaw allows attackers to read templates, snippets, and export artifacts without proper authorization, which may include sensitive or personal data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to apply the necessary access controls. If upgrading is not immediately possible, restrict access to static routes by configuring your web server (e.g., Nginx or Apache) to block unauthorized requests to /templates/, /snippets/, /export/, etc.

Ensure publish-access controls are enforced uniformly across all routes, including static ones. Disable anonymous access if not required and audit user roles to prevent unauthorized data exposure.

Useful 0 Not Useful 0