CVE-2026-72789High· 8.6▾ TwilightSiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypte…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/siyuan-note/siyuan/kernel < 0.0.0-20260726020813-a25c2dd06aaePatched in:
github.com/siyuan-note/siyuan/kernel 0.0.0-20260726020813-a25c2dd06aaeConnected by shared product, vendor, weakness, or advisory.
GHSA-xx34-6cjg-prh8Critical· 8.6Duplicate Advisory: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked
GHSA-57v5-wqx3-cgj4Medium· 5.8SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAt…
CVE-2026-72790Medium· 5.8SiYuan: Notebook name, document count, size and timestamps are returned for any notebook, including notebooks hidden from readers, by /ap…
CVE-2026-72799Medium· 5.8SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE-2026-72806Medium· 5.8SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents with…
CVE-2026-72800Medium· 5.8SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeratio…