CVE-2026-72804: CVE-2026-72804: Authentication Bypass and Sensitive Information Exposure in SiYuan Graph Endpoints

#security #cve #cybersecurity

CVE-2026-72804: Authentication Bypass and Sensitive Information Exposure in SiYuan Graph Endpoints

Vulnerability ID: CVE-2026-72804
CVSS Score: 9.2
Published: 2026-09-03

SiYuan before version 3.7.4 contains an authentication bypass vulnerability within its graph visualization API endpoints, allowing unauthenticated remote attackers to extract sensitive node metadata and content from password-protected documents.

TL;DR

Unauthenticated remote attackers can query SiYuan's graph endpoints to bypass password protection and extract private document contents and linkages.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 9.2 (Critical)
EPSS Score: 0.00255 (16.82%)
Impact: Confidentiality Exposure (High)
Exploit Status: PoC Available / Verified
CISA KEV Status: Not Listed

Affected Systems

SiYuan Knowledge Management Platform
siyuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: 82e9ded

Refactor graph filtering logic to enforce context-aware publish access control

Mitigation Strategies

Upgrade to SiYuan version 3.7.4 or later to apply context-aware authorization controls.
Restrict external access to graph API endpoints using reverse proxies or Web Application Firewalls (WAF).
Mark sensitive documents as fully Hidden instead of Password Protected to use visibility-based logic on older versions.

Remediation Steps:

Pull the latest Docker image or update the SiYuan package to v3.7.4.
Restart the SiYuan process or container.
Configure reverse proxy block rules for /api/graph/getGraph and /api/graph/getLocalGraph if an immediate update is unfeasible.

References

Read the full report for CVE-2026-72804 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community