---
id: CVE-2026-72789
title: >-
  SiYuan before v3.7.4 fails to properly validate publish access for encrypted
  notebooks, treating them as publicly accessible by default
summary: >-
  SiYuan before v3.7.4 fails to properly validate publish access for encrypted
  notebooks, treating them as publicly accessible by default. Anonymous readers
  can enumerate and retrieve fully decrypted document content from unlocked
  encrypte…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-08-12'
updated: '2026-08-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72789'
references:
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-72789'
  - url: >-
      https://github.com/siyuan-note/siyuan/commit/a25c2dd06aae13d1de70cc61cbf98169689c9d86
  - url: 'https://github.com/advisories/GHSA-v684-q882-jgmq'
  - url: 'https://github.com/siyuan-note/siyuan'
tags:
  - nvd
  - ghsa
  - go
  - osv
epss: 0.00293
epssPercentile: 0.22145
ingestedAt: '2026-08-15T21:29:27.070Z'
aliases:
  - GHSA-v684-q882-jgmq
ecosystem: go
vendor: siyuan-note
product: github.com/siyuan-note/siyuan/kernel
affected:
  - github.com/siyuan-note/siyuan/kernel < 0.0.0-20260726020813-a25c2dd06aae
patched:
  - github.com/siyuan-note/siyuan/kernel 0.0.0-20260726020813-a25c2dd06aae
---

## Overview

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-72789)

Affected packages:

- `github.com/siyuan-note/siyuan/kernel < 0.0.0-20260726020813-a25c2dd06aae`

Patched in:

- `github.com/siyuan-note/siyuan/kernel 0.0.0-20260726020813-a25c2dd06aae`

Source: https://github.com/advisories/GHSA-v684-q882-jgmq