CVE-2026-72789

critical · 9.2

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.

9.2

CVSS

0.5%

EPSS (exploit prob.)

41st

EPSS percentile

2026-08-12

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-862

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq
https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-72789