CVE-2026-72800

Deferred Deferred - Pending Action

SiYuan Publish-Access Bypass Exposes Database Schemas

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate workspace-wide block IDs without publish scoping, enabling attackers to discover valid block identifiers across publish boundaries and access content from hidden or password-protected documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72800

EUVD

EUVD-2026-57460

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)
siyuan	siyuan	From 0 (inc) to 3.7.4 (exc)
siyuan	siyuan	to 3.7.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72800 is an information disclosure vulnerability in SiYuan note-taking app versions before v3.7.4. It involves three API endpoints that fail to enforce publish-access controls. The getAttributeViewKeysByID endpoint exposes full database column schemas including descriptions and templates. The getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate block IDs across the entire workspace without proper scoping.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before v3.7.4. Use the following commands to inspect the version: On Linux, check the installed package version with 'dpkg -l siyuan' or 'rpm -qa | grep siyuan'. For Docker, run 'docker inspect <container_name> | grep -i version'. If the version is below 3.7.4, the system is vulnerable.

Additionally, monitor API traffic for requests to the vulnerable endpoints: getAttributeViewKeysByID, getBlockDefIDsByRefText, and getBlockRelevantIDs. Unusual access patterns or unauthorized data retrieval attempts may indicate exploitation.

Impact Analysis

Attackers can exploit this to retrieve sensitive database schemas and block IDs, potentially accessing content from restricted or password-protected documents. This bypasses access controls and could lead to unauthorized data exposure. The vulnerability affects any user with access to these endpoints, including anonymous users when publish authentication is disabled.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized access to sensitive information. GDPR requires appropriate technical measures to protect personal data, while HIPAA mandates safeguards for protected health information. The information disclosure could lead to compliance breaches and regulatory penalties.

Mitigation Strategies

Immediately upgrade SiYuan to version v3.7.4 or later to address the vulnerability. If upgrading is not immediately possible, restrict access to the vulnerable API endpoints by configuring publish-access filters or disabling anonymous access. Ensure Publish.Auth.Enable is set to true to enforce authentication checks.

Review and audit API logs for suspicious activity related to the vulnerable endpoints. Implement network-level controls to block unauthorized access to these endpoints if they are not required for normal operations.

Hi! I’m here to help you understand CVE-2026-72800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70