CVE-2026-72801

Deferred Deferred - Pending Action

SiYuan Pre-3.7.4 Unauthenticated Key Derivation Data Exposure

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline master-password cracking without rate limiting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-72801

EUVD

EUVD-2026-57461

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

SiYuan versions before v3.7.4 expose encryption key-derivation material and wrapped data keys through unauthenticated endpoints when running in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline master-password cracking without rate limiting.

Detection Guidance

Check if SiYuan is running in publish mode and verify the version. If the version is below 3.7.4, the system is vulnerable. Inspect network traffic for unauthenticated requests to endpoints exposing encryption key material.

Impact Analysis

An attacker could crack the master password offline, gaining access to encrypted notebooks and sensitive data. This bypasses authentication and allows unauthorized decryption of all stored information without detection.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA by exposing sensitive encrypted data and failing to ensure confidentiality. Organizations may face compliance penalties and reputational damage.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later immediately. Disable publish mode if not required. Ensure no sensitive data is exposed through unauthenticated endpoints.

Hi! I’m here to help you understand CVE-2026-72801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70