CVE-2026-72806: CVE-2026-72806: Missing Authorization in SiYuan Attribute View Rendering Leads to Information Disclosure

#security #cve #cybersecurity

CVE-2026-72806: Missing Authorization in SiYuan Attribute View Rendering Leads to Information Disclosure

Vulnerability ID: CVE-2026-72806
CVSS Score: 5.8
Published: 2026-09-03

An authorization bypass vulnerability in SiYuan prior to v3.7.4 allows unauthenticated remote attackers to access rows, block IDs, and custom attributes of password-protected documents via the attribute view rendering endpoint.

TL;DR

An unauthenticated remote attacker can bypass password-protection policies on SiYuan documents by querying database attribute views, leading to sensitive data exposure.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-862
Attack Vector: Network
CVSS v3.1 Score: 5.8 (Medium)
EPSS Score: 0.00307
Impact: Information Disclosure
Exploit Status: PoC Available
KEV Status: Not Listed

Affected Systems

SiYuan personal knowledge management platform
SiYuan: < v3.7.4 (Fixed in: v3.7.4)

Code Analysis

Commit: 768427f

Fix: Check publish block permissions correctly to resolve GHSA-6mcf-g667-w3qv and CVE-2026-72806.

Exploit Details

GitHub Security Advisory: Official advisory with details of the authorization bypass.

Mitigation Strategies

Disable Publish Mode if not strictly necessary.
Deploy IP-based ACLs or VPN access to restrict access to the hosting server.
Explicitly add sensitive, password-protected documents to the publish-ignore list in vulnerable versions.

Remediation Steps:

Verify the current running version of the SiYuan instance.
Download and install the update for SiYuan to version v3.7.4 or later.
Verify that the backend rendering endpoint correctly prompts for a password when querying views containing protected documents.

References

Read the full report for CVE-2026-72806 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community