CVE-2026-72789

Published: Aug 12, 2026Modified: Aug 26, 2026Deferred

9.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks

Source: disclosure@vulncheck.com

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.