CVE-2026-72808

Deferred Deferred - Pending Action

SiYuan Information Disclosure in PDF Annotations

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72808

EUVD

EUVD-2026-57409

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.2\|start_including=3.7.4 (inc)
siyuan	siyuan	to 3.7.2 (inc)
siyuan	siyuan	From 3.7.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects SiYuan note-taking app versions up to v3.7.2. The /api/asset/getFileAnnotation endpoint leaks private PDF annotations (highlights and notes) without proper publish-access checks. It bypasses protections in the /assets/* route, allowing anonymous users or RoleReader token holders to access restricted content if publish authentication is disabled.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version up to v3.7.2. Use the command 'curl http://localhost:6806/api/asset/getFileAnnotation?asset=test.sya' to test if the endpoint returns sensitive annotation data without proper authentication. If it does, your system may be vulnerable.

Impact Analysis

Attackers could read sensitive notes or highlights from documents that should be private, including password-protected or unpublished files. This only affects non-encrypted notebooks. The impact is limited to confidentiality breaches of annotation data.

Compliance Impact

This could violate data protection regulations like GDPR or HIPAA by exposing sensitive information without authorization. Organizations using SiYuan may face compliance risks due to unauthorized access to private annotations.

Mitigation Strategies

Immediately upgrade SiYuan to version v3.7.4 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/asset/getFileAnnotation endpoint by implementing publish-access checks similar to those used in the /assets/* route.

Hi! I’m here to help you understand CVE-2026-72808. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70