{"vulnerability": "cve-2026-7279", "sightings": [{"uuid": "c340d8e6-6755-42d5-8bdf-27e68eafbcd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7279", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkkhdtpmmh2g", "content": "", "creation_timestamp": "2026-04-28T11:13:55.847677Z"}, {"uuid": "0f877eca-9b95-4e20-aecb-e60da7af2eb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7279", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10885-02d83-2.html", "content": "", "creation_timestamp": "2026-04-28T01:54:00.000000Z"}, {"uuid": "5242a5f9-6c54-4224-948f-795775b16202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72793", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt3bpvu7ql2m", "content": "CVE-2026-72793 - siyuan\nSiYuan versions before v3.7.4 expose sensitive information, including a key used to verify user sessions and potentially allow attackers to impersonate users or gain administrator\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-14T23:10:05.692757Z"}, {"uuid": "d41d5c69-ab92-4f00-b806-ad5d35dd74d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72795", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msw5ylszbj2p", "content": "CVE-2026-72795 - siyuan\nVersions of SiYuan before 3.7.4 allow unauthorized access to sensitive content. This is a security risk because it lets attackers view documents that should be hidden or protected.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-12T22:20:03.661027Z"}, {"uuid": "080b27d7-70fc-4ed9-97c2-7896b399dd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117088094869425518", "content": "CVE-2026-72798 - High severity info disclosure in SiYuan. Unpatched v3.7.4 lets anonymous readers access hidden database content via related-database bypass. CVSS 8.6. Update immediately. #CVE #SiYuan #infosec\nhttps://www.valtersit.com/cve/CVE-2026-72798/", "creation_timestamp": "2026-08-13T12:02:24.788069Z"}, {"uuid": "06809748-6f40-4920-a572-20227f3186c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msxlwydfsb2k", "content": "CVE-2026-72798 - High severity info disclosure in SiYuan. Unpatched v3.7.4 lets anonymous readers access hidden database content via related-database bypass. CVSS 8.6. Update immediately. #CVE #SiYuan #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-72798/", "creation_timestamp": "2026-08-13T12:02:21.474270Z"}, {"uuid": "ad410fa8-9043-4360-89ea-17d20dae235d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72796", "type": "seen", "source": "https://gist.github.com/alon710/78668aa7363409db44eada4d30afb2b9", "content": "# CVE-2026-72796: CVE-2026-72796: Access Control Bypass via Static Routes in SiYuan\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72796\n\n## Summary\nA detailed technical breakdown of CVE-2026-72796 (GHSA-fgmr-7w36-9qfq), an access control bypass vulnerability in the SiYuan personal knowledge management system. Prior to version 3.7.4, inconsistent authorization checks between dynamic API endpoints and static file routes allowed authenticated low-privilege readers or anonymous public users to read sensitive files, templates, snippets, and export directories.\n\n## TL;DR\nInconsistent authorization controls in SiYuan prior to v3.7.4 permitted low-privilege or anonymous readers to bypass REST API security filters and download sensitive templates, snippets, widgets, and ZIP backups by accessing their static routes directly.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 5.8 (Medium)\n- **EPSS Score**: 0.00257 (17.14th percentile)\n- **Impact**: Confidentiality\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n\n## Mitigation\n\n- Upgrade to SiYuan version 3.7.4 or later to enforce administrative controls on static templates and exports.\n- Enable dynamic Markdown-AST-based asset validation to restrict public file reads to actively linked resources.\n- Isolate the self-hosted application behind a reverse proxy or VPN to prevent public access to server ports.\n\n**Remediation Steps:**\n1. Identify all running SiYuan instances and record their current version numbers.\n2. For Docker-based instances, execute 'docker pull b3log/siyuan:v3.7.4' to download the patched container image.\n3. Stop the existing container and launch the new container using the updated image tag while maintaining volume mappings.\n4. Verify that requests to static endpoints such as '/templates/' return 403 Forbidden for non-administrative users.\n\n## References\n\n- [GitHub Security Advisory GHSA-fgmr-7w36-9qfq](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fgmr-7w36-9qfq)\n- [SiYuan Fix Commit 34be6c0](https://github.com/siyuan-note/siyuan/commit/34be6c0bb0739d5b8e99ecc0cbfb474abb16230d)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72796) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T21:32:38.808652Z"}, {"uuid": "97b00419-e9a0-445c-aa10-db6c436c6939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72792", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-mp7r-57w4-5qm3", "content": "", "creation_timestamp": "2026-09-04T22:35:03.485719Z"}, {"uuid": "c4ac6f3f-8dfb-4738-bca2-7bda277b4f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72793", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-h4v5-crx2-3cv4", "content": "", "creation_timestamp": "2026-09-04T22:35:05.601384Z"}, {"uuid": "bb3a38af-df90-4fa2-b56a-dd42c7f0af17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72795", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-h6w7-xxcf-w2mq", "content": "", "creation_timestamp": "2026-09-04T22:35:07.726777Z"}, {"uuid": "749f694d-5d7b-4c69-bd1e-75a475c0bc72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72794", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-34fj-mwm6-fjfg", "content": "", "creation_timestamp": "2026-09-04T22:35:09.835502Z"}, {"uuid": "54f42508-1cfe-4b77-ab5a-77dcaf6927d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72796", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-fgmr-7w36-9qfq", "content": "", "creation_timestamp": "2026-09-04T22:35:12.152357Z"}, {"uuid": "27b13757-3d26-4e12-b6df-4766543f50f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72797", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-f2rw-w22v-54vh", "content": "", "creation_timestamp": "2026-09-04T22:35:14.256247Z"}, {"uuid": "0505f552-0439-4bde-9aa7-4c9f5611eac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72798", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-mfrj-v65r-979c", "content": "", "creation_timestamp": "2026-09-04T22:35:16.386530Z"}, {"uuid": "68046f44-ff15-43a9-b72f-b41cb0365924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72799", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5w7r-f4cg-rqq7", "content": "", "creation_timestamp": "2026-09-04T22:35:23.800165Z"}, {"uuid": "ef1305cf-5de8-4fe4-9d47-0927a0df04e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72792", "type": "seen", "source": "https://gist.github.com/alon710/90178cd17fc0b9e9f8bf4b855dea8ff1", "content": "# CVE-2026-72792: CVE-2026-72792: Information Disclosure via Tag API Endpoint in SiYuan\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72792\n\n## Summary\nSiYuan before version v3.7.4 is affected by an information disclosure vulnerability in the `/api/tag/getTag` endpoint. Under publish mode, this endpoint returns tag labels and occurrence counts from password-protected documents to unauthenticated readers, allowing them to enumerate protected vocabulary and internal metadata without providing the document's publish password.\n\n## TL;DR\nUnauthenticated remote attackers can query `/api/tag/getTag` in SiYuan instances running in publish mode to extract tag vocabulary and metadata from password-protected documents.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237 (Percentile: 14.53%)\n- **Impact**: Information Disclosure (Metadata Leakage)\n- **Exploit Status**: PoC available\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later\n- Implement reverse proxy blocking rules for `/api/tag/getTag` if upgrades are not feasible\n- Enforce strong, complex passwords for protected documents to prevent offline brute-force cookie creation\n\n**Remediation Steps:**\n1. Identify all public or published SiYuan instances running versions prior to v3.7.4\n2. Deploy the update to v3.7.4 or newer immediately\n3. If immediate patching is unavailable, block the path `/api/tag/getTag` using Nginx or an equivalent web server config\n4. Audit and rotate critical document passwords to ensure high-entropy values are in use\n\n## References\n\n- [GitHub Security Advisory GHSA-mp7r-57w4-5qm3](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mp7r-57w4-5qm3)\n- [SiYuan Fix Commit 4515fa257cfae2db0a43844c61de8ef1ac853796](https://github.com/siyuan-note/siyuan/commit/4515fa257cfae2db0a43844c61de8ef1ac853796)\n- [VulnCheck Advisory for SiYuan](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-tag-api)\n- [CVE-2026-72792 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-72792)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72792) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T04:31:40.416871Z"}, {"uuid": "1c58d0db-df1c-4c4e-a64f-f54441029a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72793", "type": "seen", "source": "https://gist.github.com/alon710/8e52edc7cac5d27a87a28f37b7cbdf23", "content": "# CVE-2026-72793: CVE-2026-72793: Information Disclosure and Session Forgery in SiYuan Note-Taking Application\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72793\n\n## Summary\nA critical information disclosure vulnerability in the SiYuan note-taking application allows remote attackers to retrieve sensitive configurations, including cryptographic session-cookie signing keys and absolute host system directories, leading to administrative session hijacking.\n\n## TL;DR\nIncomplete secret masking in the `/api/system/getConf` endpoint of SiYuan before v3.7.4 exposes session-cookie signing keys and absolute system directories, allowing attackers to hijack administrative sessions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 8.6 (v3.1) / 9.2 (v4.0)\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n- **Vulnerability Type**: Information Disclosure / Insufficiently Protected Credentials\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade the SiYuan note-taking application to version 3.7.4 or later.\n- Enforce strong access-authorization codes in the application settings.\n- Rotate the session-cookie configuration parameters after upgrading.\n\n**Remediation Steps:**\n1. Identify all active SiYuan deployments in your environment.\n2. Download and apply the v3.7.4 or later update package.\n3. Access the settings panel and set a complex access-authorization code.\n4. Restart the service to generate a new session cookie key and invalidate old sessions.\n\n## References\n\n- [GHSA-h4v5-crx2-3cv4: SiYuan Information Disclosure in getConf](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4)\n- [VulnCheck Independent Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-api-system-getconf)\n- [Remediation Patch Commit](https://github.com/siyuan-note/siyuan/commit/2d8b98395a910251aea87e90a4fad9c7f954befe)\n- [Official CVE Entry Record](https://www.cve.org/CVERecord?id=CVE-2026-72793)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72793) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T05:32:57.610433Z"}, {"uuid": "943447b5-2b4b-46c1-a239-8da9fbaa7a25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72795", "type": "seen", "source": "https://gist.github.com/alon710/d6618765d21c6f9ee71dda70fcd7fb39", "content": "# CVE-2026-72795: CVE-2026-72795: Missing Authorization in SiYuan Block DOM Rendering\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72795\n\n## Summary\nCVE-2026-72795 is a critical missing authorization vulnerability (CWE-862) in SiYuan, a self-hosted personal knowledge platform. When configured in publish/read-only mode, the application fails to validate publish-access rules on dynamic child blocks transcluded via SQL queries. This allows anonymous external visitors to access hidden, password-protected, or forbidden note content.\n\n## TL;DR\nUnauthenticated information exposure in SiYuan note platform allows remote anonymous attackers to view private note content via missing authorization checks in dynamic block transclusion endpoints.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 9.2\n- **EPSS Score**: 0.00241\n- **Exploit Status**: PoC / Technical Analysis\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge-management platform\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.4 or later.\n- Disable public publishing or dynamic embeds on public-facing documents.\n- Enforce reverse-proxy authenticated access.\n\n**Remediation Steps:**\n1. Identify any active public documents in the SiYuan instance.\n2. Temporarily disable public sharing or block embed components.\n3. Pull the latest Docker image or binary package for SiYuan >= v3.7.4.\n4. Restart the instance and verify the access-control validation on published pages.\n\n## References\n\n- [GHSA-h6w7-xxcf-w2mq: Security Advisory](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mq)\n- [VulnCheck Vulnerability Report](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-embed-block)\n- [Fix Commit 1ca1c3c](https://github.com/siyuan-note/siyuan/commit/1ca1c3c9d94bea14fc9728ff2fb8392bb0f29732)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72795) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T06:34:06.728269Z"}, {"uuid": "bf4924b6-977e-48fe-968c-a9dd376ad45a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72794", "type": "seen", "source": "https://gist.github.com/alon710/dc010738b4571d3213f407464873e777", "content": "# CVE-2026-72794: CVE-2026-72794: Cryptographic Key Leakage and Session Forgery in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72794\n\n## Summary\nAn information disclosure vulnerability in the SiYuan application exposes the global session cookie signing key via the `/api/system/getConf` endpoint. This allows unauthenticated remote attackers or low-privileged users to forge administrative session cookies and gain unauthorized access to the application kernel.\n\n## TL;DR\nUnauthenticated remote attackers can extract the session-signing secret key from the configuration endpoint and forge session cookies to obtain administrative access.\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 8.6\n- **EPSS Score**: 0.00249\n- **Exploit Status**: PoC available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **siyuan**: < 3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade to SiYuan v3.7.4 or later\n- Rotate the exposed CookieKey in the configuration file\n- Enforce access controls on the network level for the admin API\n\n**Remediation Steps:**\n1. Stop the SiYuan service instance\n2. Backup the configuration file (conf.json)\n3. Update the application binaries to version 3.7.4\n4. Locate the 'CookieKey' field in the configuration and replace it with a new cryptographically secure random string\n5. Restart the SiYuan service\n6. Verify that accessing /api/system/getConf without credentials no longer returns the cookieKey parameter\n\n## References\n\n- [GHSA-34fj-mwm6-fjfg: Session Cookie Key Disclosure in SiYuan](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34fj-mwm6-fjfg)\n- [Fix Commit: Clear CookieKey in GetMaskedConf and HideConfSecret](https://github.com/siyuan-note/siyuan/commit/77421530be4ab1f43310d0f50fbab05d16c38675)\n- [VulnCheck Advisory: SiYuan Session Cookie Key Disclosure](https://www.vulncheck.com/advisories/siyuan-before-session-cookie-key-disclosure-via-getconf)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72794) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T07:32:25.151952Z"}, {"uuid": "cb00c9ab-9f2d-4cde-9839-18f79b89468e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72797", "type": "seen", "source": "https://gist.github.com/alon710/9a2d85ba8ea8d9357fd9b222ff82f01a", "content": "# CVE-2026-72797: CVE-2026-72797: Missing Authorization in SiYuan Notebook Metadata Endpoint\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72797\n\n## Summary\nAn information disclosure vulnerability exists in SiYuan prior to v3.7.4 due to missing authorization checks on the getEncryptedNotebookStatus API endpoint, allowing unprivileged or anonymous users to enumerate protected notebooks.\n\n## TL;DR\nUnauthenticated remote attackers can query the /api/notebook/getEncryptedNotebookStatus endpoint to discover sensitive notebook names, IDs, and lock states.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Exploit Status**: Proof-of-Concept (via tests)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Sensitive Metadata Leakage\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Update SiYuan to v3.7.4 or later\n- Restrict access to the local or server-side API port using network security groups\n- Disable public/anonymous reading features if not required\n\n**Remediation Steps:**\n1. Verify current running version of SiYuan using the settings menu or container tags.\n2. Download and apply the update to version 3.7.4 or higher.\n3. Verify endpoint restriction by executing a request using a non-admin token and ensuring a 403 Forbidden status is returned.\n\n## References\n\n- [GitHub Security Advisory GHSA-f2rw-w22v-54vh](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f2rw-w22v-54vh)\n- [Fix Commit (GitHub)](https://github.com/siyuan-note/siyuan/commit/8fb1b5766093371f6a516c221c92026b904fe779)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-72797)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getencryptednotebookstatus)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72797) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T08:31:47.875616Z"}, {"uuid": "e9247a9d-7b7d-4051-88b7-5deadbdfb891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://gist.github.com/alon710/eb15ac5c0e28dcec3fbc7013caed5d8c", "content": "# CVE-2026-72798: CVE-2026-72798: Missing Authorization and Information Disclosure in SiYuan renderAttributeView\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72798\n\n## Summary\nPrior to version v3.7.4, the SiYuan personal knowledge management system contained a critical logical authorization vulnerability within its database view rendering component. The flaws allowed unauthenticated remote attackers to bypass publish-access filters on databases, exposing sensitive Relation and Rollup cell contents belonging to private or password-protected repositories.\n\n## TL;DR\nMissing authorization checks in SiYuan renderAttributeView allow anonymous readers to bypass database access controls and extract sensitive cell data from hidden or password-protected databases via crafted API requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00256\n- **Exploit Status**: Proof-of-Concept / Theoretical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade the SiYuan personal knowledge management system to version v3.7.4 or newer\n- Enforce network boundaries by binding the local API server exclusively to localhost or protected interfaces\n- Minimize the use of public-facing relation columns that bridge public databases with private schemas\n\n**Remediation Steps:**\n1. Obtain the v3.7.4 release of SiYuan\n2. Verify the configured listen parameters in conf.json to ensure the system does not expose port 6806 publicly\n3. Deploy a secure, authenticated reverse proxy layer over any external instance access\n\n## References\n\n- [SiYuan Security Advisory GHSA-mfrj-v65r-979c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mfrj-v65r-979c)\n- [SiYuan Fix Commit 426991d](https://github.com/siyuan-note/siyuan/commit/426991d155c0c7c3a9e71badd6761eddfa8aad5b)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-renderattributeview)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72798) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T09:31:32.420102Z"}, {"uuid": "a7a5985a-4da3-489d-9d02-34cd06ceccbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72799", "type": "seen", "source": "https://gist.github.com/alon710/abc6a26fdebf669c87f091f304527249", "content": "# CVE-2026-72799: CVE-2026-72799: Missing Authorization in SiYuan Filetree Path-Resolution API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72799\n\n## Summary\nSiYuan before v3.7.4 fails to enforce publish-access filters on five filetree path-resolution endpoints, allowing unauthenticated attackers to reconstruct private directory layouts and map document structures.\n\n## TL;DR\nUnauthenticated remote attackers can query specific path-resolution APIs in SiYuan to discover the structures, names, and IDs of private, hidden, or password-protected documents when deployed in public publish mode.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v4.0**: 6.9\n- **EPSS Score**: 0.00237 (Percentile: 14.53%)\n- **Impact**: Information Disclosure / Metadata Leakage\n- **Exploit Status**: Proof-of-Concept / Patch-based Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or higher.\n- Enable Publish Authentication by setting Publish.Auth.Enable to true.\n- Restrict access to /api/filetree/ endpoints using a reverse proxy.\n\n**Remediation Steps:**\n1. Identify self-hosted SiYuan installations and check current version numbers.\n2. Update the application deployment using the official Docker image or binary to v3.7.4.\n3. Verify the updated installation by attempting to query /api/filetree/getHPathByID without an active authorization token.\n\n## References\n\n- [GitHub Security Advisory GHSA-5w7r-f4cg-rqq7](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5w7r-f4cg-rqq7)\n- [Fix Commit 5bae092](https://github.com/siyuan-note/siyuan/commit/5bae0926b896eaff0bc5cc6a75d421c2d161a806)\n- [CVE-2026-72799 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-72799)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72799) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T10:31:56.346667Z"}, {"uuid": "523c4ad9-89fc-4b53-bc45-449ca176925d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72790", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-74pj-6g7r-j55c", "content": "", "creation_timestamp": "2026-09-08T18:35:10.571572Z"}]}