CVE-2026-72792: CVE-2026-72792: Information Disclosure via Tag API Endpoint in SiYuan

#security #cve #cybersecurity

CVE-2026-72792: Information Disclosure via Tag API Endpoint in SiYuan

Vulnerability ID: CVE-2026-72792
CVSS Score: 6.9
Published: 2026-09-04

SiYuan before version v3.7.4 is affected by an information disclosure vulnerability in the /api/tag/getTag endpoint. Under publish mode, this endpoint returns tag labels and occurrence counts from password-protected documents to unauthenticated readers, allowing them to enumerate protected vocabulary and internal metadata without providing the document's publish password.

TL;DR

Unauthenticated remote attackers can query /api/tag/getTag in SiYuan instances running in publish mode to extract tag vocabulary and metadata from password-protected documents.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-863
Attack Vector: Network
CVSS Score: 6.9 (Medium)
EPSS Score: 0.00237 (Percentile: 14.53%)
Impact: Information Disclosure (Metadata Leakage)
Exploit Status: PoC available
KEV Status: Not listed in CISA KEV

Affected Systems

SiYuan personal knowledge management system
SiYuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 4515fa2

Fix information disclosure in getTag endpoint by validating publish passwords

Exploit Details

GitHub Security Advisory: Official security advisory containing details on the tag leak vulnerability.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later
Implement reverse proxy blocking rules for /api/tag/getTag if upgrades are not feasible
Enforce strong, complex passwords for protected documents to prevent offline brute-force cookie creation

Remediation Steps:

Identify all public or published SiYuan instances running versions prior to v3.7.4
Deploy the update to v3.7.4 or newer immediately
If immediate patching is unavailable, block the path /api/tag/getTag using Nginx or an equivalent web server config
Audit and rotate critical document passwords to ensure high-entropy values are in use

References

Read the full report for CVE-2026-72792 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community