CVE-2026-74799

Published: Aug 17, 2026Modified: Aug 26, 2026Deferred

9.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

Related CWEs

CWE-215

Insertion of Sensitive Information Into Debugging Code

The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.

References (3)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqq-p2hw-mj3f

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/siyuan-before-unauthenticated-debug-endpoint-information-disclosure

Source: disclosure@vulncheck.com

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqq-p2hw-mj3f

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.