DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72810: CVE-2026-72810: Publish-Boundary Bypass and Real-Time Data Leakage via WebSocket Session Pollution in SiYuan

#security #cve #cybersecurity

CVE-2026-72810: Publish-Boundary Bypass and Real-Time Data Leakage via WebSocket Session Pollution in SiYuan

Vulnerability ID: CVE-2026-72810
CVSS Score: 8.6
Published: 2026-09-03

CVE-2026-72810 is a critical publish-boundary bypass vulnerability in the SiYuan personal knowledge management system before version 3.7.4. The flaw lies in the backend real-time WebSocket broadcast mechanism. When configured in public publish mode, the system fails to differentiate between unauthenticated public reader sessions and authorized administrative sessions within its global connection pool. This architectural oversight allows unauthenticated remote attackers connecting to the public WebSocket endpoint on port 6808 to passively receive real-time, raw workspace modification events, including keystroke logs, block updates, and content from protected or forbidden documents.

TL;DR

A session-pollution flaw in SiYuan's WebSocket implementation allows anonymous network users to passively intercept all real-time workspace edits, bypassing publication boundaries.

Technical Details

  • CWE ID: CWE-862 (Missing Authorization)
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.6 (High)
  • CVSS v4.0 Score: 9.2 (Critical)
  • EPSS Score: 0.00313 (0.313%)
  • Exploit Status: none
  • CISA KEV Status: Not Listed

Affected Systems

  • SiYuan personal knowledge management system
  • SiYuan: < 3.7.4 (Fixed in: 3.7.4)

Code Analysis

Commit: ba94863

Fix publish service token and filter out publish sessions during WebSocket broadcasts

Mitigation Strategies

  • Upgrade SiYuan to version 3.7.4 or later.
  • Restrict public network exposure to the WebSocket port (6808).
  • Configure reverse proxy rules to block unauthorized /ws handshakes.

Remediation Steps:

  1. Verify the current running version of the SiYuan application.
  2. Pull and deploy the SiYuan container image or application binary for version 3.7.4 or later.
  3. Ensure firewall rules or security groups restrict access to administrative ports on public interfaces.
  4. Conduct a review of reverse-proxy rules to ensure WebSocket path /ws is protected.

References

Read the full report for CVE-2026-72810 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)