CVE-2026-72798: Missing Authorization and Information Disclosure in SiYuan renderAttributeView
Vulnerability ID: CVE-2026-72798
CVSS Score: 9.2
Published: 2026-09-04
Prior to version v3.7.4, the SiYuan personal knowledge management system contained a critical logical authorization vulnerability within its database view rendering component. The flaws allowed unauthenticated remote attackers to bypass publish-access filters on databases, exposing sensitive Relation and Rollup cell contents belonging to private or password-protected repositories.
TL;DR
Missing authorization checks in SiYuan renderAttributeView allow anonymous readers to bypass database access controls and extract sensitive cell data from hidden or password-protected databases via crafted API requests.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v4.0 Base Score: 9.2 (Critical)
- EPSS Score: 0.00256
- Exploit Status: Proof-of-Concept / Theoretical Analysis
- KEV Status: Not Listed
Affected Systems
- SiYuan Personal Knowledge Management System
-
SiYuan: < 3.7.4 (Fixed in:
3.7.4)
Code Analysis
Commit: 426991d
Filter attribute view by publish access recursively to fix relation leakage
Mitigation Strategies
- Upgrade the SiYuan personal knowledge management system to version v3.7.4 or newer
- Enforce network boundaries by binding the local API server exclusively to localhost or protected interfaces
- Minimize the use of public-facing relation columns that bridge public databases with private schemas
Remediation Steps:
- Obtain the v3.7.4 release of SiYuan
- Verify the configured listen parameters in conf.json to ensure the system does not expose port 6806 publicly
- Deploy a secure, authenticated reverse proxy layer over any external instance access
References
Read the full report for CVE-2026-72798 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)