CVE-2026-72808: Unauthorized PDF Annotation Access in SiYuan Knowledge Management System
Vulnerability ID: CVE-2026-72808
CVSS Score: 6.9
Published: 2026-09-03
An information disclosure vulnerability in the SiYuan knowledge management system versions up to and including v3.7.2 allows remote unauthorized attackers to retrieve PDF annotations via the /api/asset/getFileAnnotation endpoint due to missing authorization checks.
TL;DR
Unauthenticated or read-only users can bypass asset-level restrictions to retrieve sensitive PDF annotations from unpublished or password-protected documents.
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v4.0 Score: 6.9 (Medium)
- EPSS Score: 0.00283 (Percentile: 20.46%)
- Impact: Information Disclosure (Access to PDF Annotations)
- Exploit Status: No public functional exploit
- CISA KEV Status: Not Listed
Affected Systems
- SiYuan
-
SiYuan: <= v3.7.2 (Fixed in:
v3.7.4)
Code Analysis
Commit: 509b350
Fix getFileAnnotation permission check
Mitigation Strategies
- Restrict external access to the /api/asset/getFileAnnotation endpoint.
- Upgrade SiYuan to version 3.7.4 or later.
- Encrypt notebooks containing sensitive data.
Remediation Steps:
- Analyze reverse proxy or server logs for requests to /api/asset/getFileAnnotation.
- Deploy network or reverse proxy rules to drop unauthorized access to API endpoints.
- Upgrade to SiYuan v3.7.4.
- Review active publish access settings and restrict public exposure of unpublished assets.
References
Read the full report for CVE-2026-72808 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)