{"uuid": "b57fed49-2f13-4aac-b3f0-d2817962bfc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72801", "type": "seen", "source": "https://gist.github.com/alon710/a6fd2dd8c86786415f62d46033a7b9e2", "content": "# CVE-2026-72801: CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72801\n\n## Summary\nAn access control vulnerability in the SiYuan personal knowledge management platform before version v3.7.4 exposes notebook encryption parameters to unauthenticated remote attackers. When the platform is configured in Publish Mode, specific API endpoints fail to enforce authorization checks. This access failure leaks key-derivation materials, password verifiers, and wrapped database keys to anonymous network clients.\n\n## TL;DR\nUnauthenticated endpoints in SiYuan before version v3.7.4 disclose Argon2id salts, cost parameters, password verifiers, and wrapped AES keys when Publish Mode is enabled. Attackers can leverage this material to execute high-speed, offline brute-force attacks to decrypt local notebook files.\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7\n- **EPSS Score**: 0.00241 (Percentile: 15.12%)\n- **Impact**: Complete Cryptographic Information Disclosure\n- **Exploit Status**: No known public exploit\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management Platform\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Immediately upgrade SiYuan to version v3.7.4 or later\n- Disable the built-in Publish Mode feature if public sharing is not actively required\n- Configure reverse proxy rules to restrict access to administrative API endpoints\n- Rotate notebook master passwords to generate fresh cryptographic key material\n\n**Remediation Steps:**\n1. Check the running version of the SiYuan application by navigating to the system information panel\n2. Deploy the updated SiYuan v3.7.4 binary or pull the latest Docker container tag from the official repository\n3. If running behind Nginx, add a location block to return 403 Forbidden for unauthenticated paths matching /api/notebook/\n4. Change the master password for all notebooks that were published externally to invalidate any previously harvested keys\n\n## References\n\n- [GitHub Security Advisory GHSA-8x84-r2ff-h8pq](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8x84-r2ff-h8pq)\n- [VulnCheck Advisory for SiYuan Information Disclosure](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-encryption-key-material)\n- [CVE.org Record CVE-2026-72801](https://www.cve.org/CVERecord?id=CVE-2026-72801)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72801) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T03:02:58.239381Z"}