DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72800: CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System

#security #cve #cybersecurity

CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System

Vulnerability ID: CVE-2026-72800
CVSS Score: 5.8
Published: 2026-09-03

A security vulnerability in the SiYuan local-first personal knowledge management system allows unauthenticated remote attackers to bypass logical boundary controls in publish (read-only) mode. By interacting with endpoints that lack proper publish-access validation, an attacker can disclose the application's internal database schemas and harvest block IDs across both public and private notebooks. This metadata leakage compromises the confidentiality of restricted documents and provides foundational information for targeted extraction.

TL;DR

Missing authorization checks in SiYuan's publish-mode API endpoints allow unauthenticated attackers to discover database schemas and private block IDs across the entire workspace.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network (Unauthenticated)
  • CVSS v3.1 Score: 5.8 (Medium)
  • CVSS v4.0 Score: 6.9 (Medium)
  • EPSS Score: 0.00237
  • EPSS Percentile: 14.51%
  • Exploit Status: poc
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan Note-taking Application
  • SiYuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 931ba69

Enforce publish-access checks on block tree and sibling lookup handlers inside kernel/api/block.go.

Commit: f363319

Apply CheckReadonly middleware to getAttributeViewKeysByID API route and filter block definition arrays.

Mitigation Strategies

  • Upgrade SiYuan deployments to version 3.7.4 or newer immediately.
  • Deploy reverse proxy rules to drop external traffic targeting sensitive api routes under /api/av/ and /api/block/.
  • Monitor application access logs for unexpected POST requests to missing middleware routes.

Remediation Steps:

  1. Identify all internet-exposed SiYuan instances running in publish or read-only mode.
  2. Update the SiYuan application binaries or Docker containers to version 3.7.4.
  3. Verify that the POST /api/av/getAttributeViewKeysByID endpoint returns authorization errors for unauthenticated web requests.
  4. Restart the service and confirm proper access control behaviors.

References

Read the full report for CVE-2026-72800 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)