CVE-2026-72795: Missing Authorization in SiYuan Block DOM Rendering
Vulnerability ID: CVE-2026-72795
CVSS Score: 9.2
Published: 2026-09-04
CVE-2026-72795 is a critical missing authorization vulnerability (CWE-862) in SiYuan, a self-hosted personal knowledge platform. When configured in publish/read-only mode, the application fails to validate publish-access rules on dynamic child blocks transcluded via SQL queries. This allows anonymous external visitors to access hidden, password-protected, or forbidden note content.
TL;DR
Unauthenticated information exposure in SiYuan note platform allows remote anonymous attackers to view private note content via missing authorization checks in dynamic block transclusion endpoints.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v4.0 Score: 9.2
- EPSS Score: 0.00241
- Exploit Status: PoC / Technical Analysis
- CISA KEV Status: Not Listed
Affected Systems
- SiYuan personal knowledge-management platform
-
siyuan: < 3.7.4 (Fixed in:
3.7.4)
Code Analysis
Commit: 1ca1c3c
Fix: Check block access control before transclusion in DOM rendering engine.
Exploit Details
- GitHub Security Advisory: GHSA detailed advisory documenting missing authorization on transcluded blocks.
Mitigation Strategies
- Upgrade SiYuan to version 3.7.4 or later.
- Disable public publishing or dynamic embeds on public-facing documents.
- Enforce reverse-proxy authenticated access.
Remediation Steps:
- Identify any active public documents in the SiYuan instance.
- Temporarily disable public sharing or block embed components.
- Pull the latest Docker image or binary package for SiYuan >= v3.7.4.
- Restart the instance and verify the access-control validation on published pages.
References
Read the full report for CVE-2026-72795 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)