CVE-2026-72797: CVE-2026-72797: Missing Authorization in SiYuan Notebook Metadata Endpoint

#security #cve #cybersecurity

CVE-2026-72797: Missing Authorization in SiYuan Notebook Metadata Endpoint

Vulnerability ID: CVE-2026-72797
CVSS Score: 6.9
Published: 2026-09-04

An information disclosure vulnerability exists in SiYuan prior to v3.7.4 due to missing authorization checks on the getEncryptedNotebookStatus API endpoint, allowing unprivileged or anonymous users to enumerate protected notebooks.

TL;DR

Unauthenticated remote attackers can query the /api/notebook/getEncryptedNotebookStatus endpoint to discover sensitive notebook names, IDs, and lock states.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 6.9 (Medium)
Exploit Status: Proof-of-Concept (via tests)
CISA KEV Status: Not Listed
Impact: Sensitive Metadata Leakage

Affected Systems

SiYuan Personal Knowledge Management System
SiYuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 8fb1b57

Add model.CheckAdminRole to /api/notebook/getEncryptedNotebookStatus endpoint and implement authorization unit tests.

Mitigation Strategies

Update SiYuan to v3.7.4 or later
Restrict access to the local or server-side API port using network security groups
Disable public/anonymous reading features if not required

Remediation Steps:

Verify current running version of SiYuan using the settings menu or container tags.
Download and apply the update to version 3.7.4 or higher.
Verify endpoint restriction by executing a request using a non-admin token and ensuring a 403 Forbidden status is returned.

References

Read the full report for CVE-2026-72797 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community