CVE-2026-72789
9.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Summary
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | 0 < 3.7.4 | affected |
| siyuan-note | siyuan | 3.7.4 | unaffected |
Weaknesses
- CWE-862: Missing Authorization
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq
- https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.