DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72796: CVE-2026-72796: Access Control Bypass via Static Routes in SiYuan

#security #cve #cybersecurity

CVE-2026-72796: Access Control Bypass via Static Routes in SiYuan

Vulnerability ID: CVE-2026-72796
CVSS Score: 5.8
Published: 2026-09-04

A detailed technical breakdown of CVE-2026-72796 (GHSA-fgmr-7w36-9qfq), an access control bypass vulnerability in the SiYuan personal knowledge management system. Prior to version 3.7.4, inconsistent authorization checks between dynamic API endpoints and static file routes allowed authenticated low-privilege readers or anonymous public users to read sensitive files, templates, snippets, and export directories.

TL;DR

Inconsistent authorization controls in SiYuan prior to v3.7.4 permitted low-privilege or anonymous readers to bypass REST API security filters and download sensitive templates, snippets, widgets, and ZIP backups by accessing their static routes directly.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Attack Vector: Network
  • CVSS Score: 5.8 (Medium)
  • EPSS Score: 0.00257 (17.14th percentile)
  • Impact: Confidentiality
  • Exploit Status: Proof-of-Concept
  • KEV Status: Not Listed

Affected Systems

  • SiYuan Personal Knowledge Management System

Mitigation Strategies

  • Upgrade to SiYuan version 3.7.4 or later to enforce administrative controls on static templates and exports.
  • Enable dynamic Markdown-AST-based asset validation to restrict public file reads to actively linked resources.
  • Isolate the self-hosted application behind a reverse proxy or VPN to prevent public access to server ports.

Remediation Steps:

  1. Identify all running SiYuan instances and record their current version numbers.
  2. For Docker-based instances, execute 'docker pull b3log/siyuan:v3.7.4' to download the patched container image.
  3. Stop the existing container and launch the new container using the updated image tag while maintaining volume mappings.
  4. Verify that requests to static endpoints such as '/templates/' return 403 Forbidden for non-administrative users.

References

Read the full report for CVE-2026-72796 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)