CVE-2026-72810
Received Received - Intake

SiYuan Publish-Boundary Bypass via WebSocket

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72810
EUVD
EUVD-2026-58625

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72810 is a publish-boundary bypass vulnerability in SiYuan versions before v3.7.4. It allows unauthenticated attackers to exploit WebSocket broadcast sessions to receive real-time content events, including edits to password-protected or restricted documents, without proper authorization.

Detection Guidance

Check if SiYuan is running on port 6808 and verify if Publish.Auth.Enable is set to false. Monitor WebSocket connections to port 6808 with RoleReader role to detect unauthorized access attempts.

Impact Analysis

Attackers can passively receive sensitive information such as document titles, notebook names, block attributes, and document structure. This includes confidential data from password-protected or restricted documents, leading to unauthorized data exposure without requiring privileges or user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive personal data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Organizations using affected SiYuan versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later. Ensure Publish.Auth.Enable is set to true to enforce authentication for WebSocket connections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72810. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart