DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72801: CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan

#security #cve #cybersecurity

CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan

Vulnerability ID: CVE-2026-72801
CVSS Score: 8.7
Published: 2026-09-03

An access control vulnerability in the SiYuan personal knowledge management platform before version v3.7.4 exposes notebook encryption parameters to unauthenticated remote attackers. When the platform is configured in Publish Mode, specific API endpoints fail to enforce authorization checks. This access failure leaks key-derivation materials, password verifiers, and wrapped database keys to anonymous network clients.

TL;DR

Unauthenticated endpoints in SiYuan before version v3.7.4 disclose Argon2id salts, cost parameters, password verifiers, and wrapped AES keys when Publish Mode is enabled. Attackers can leverage this material to execute high-speed, offline brute-force attacks to decrypt local notebook files.

Technical Details

  • CWE ID: CWE-522
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.7
  • EPSS Score: 0.00241 (Percentile: 15.12%)
  • Impact: Complete Cryptographic Information Disclosure
  • Exploit Status: No known public exploit
  • KEV Status: Not listed

Affected Systems

  • SiYuan Personal Knowledge Management Platform
  • SiYuan: < v3.7.4 (Fixed in: v3.7.4)

Mitigation Strategies

  • Immediately upgrade SiYuan to version v3.7.4 or later
  • Disable the built-in Publish Mode feature if public sharing is not actively required
  • Configure reverse proxy rules to restrict access to administrative API endpoints
  • Rotate notebook master passwords to generate fresh cryptographic key material

Remediation Steps:

  1. Check the running version of the SiYuan application by navigating to the system information panel
  2. Deploy the updated SiYuan v3.7.4 binary or pull the latest Docker container tag from the official repository
  3. If running behind Nginx, add a location block to return 403 Forbidden for unauthenticated paths matching /api/notebook/
  4. Change the master password for all notebooks that were published externally to invalidate any previously harvested keys

References

Read the full report for CVE-2026-72801 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)