{"vulnerability": "cve-2026-7280", "sightings": [{"uuid": "d52c4c94-eae3-4123-8fa7-d4b25ce09a91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-7280", "type": "seen", "source": "https://www.twcert.org.tw/en/cp-139-10885-02d83-2.html", "content": "", "creation_timestamp": "2026-04-28T01:54:00.000000Z"}, {"uuid": "506aba9c-628d-4d43-bcc0-ffef6b1656ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72803", "type": "seen", "source": "https://gist.github.com/alon710/6d84a03746a753dea4049dd4a31c2df7", "content": "# CVE-2026-72803: CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72803\n\n## Summary\nAn information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.\n\n## TL;DR\nUnauthenticated remote attackers can bypass document-level protection rules (such as passwords or disabled-publish states) to read sensitive block metadata by directly querying the `getBlockAttrs` and `batchGetBlockAttrs` endpoints with known block IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237 (0.237%)\n- **Impact**: Partial Confidentiality Loss\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later.\n- Restrict access to vulnerable API endpoints via reverse proxy rules.\n- Avoid storing highly sensitive credentials or text within block attributes.\n\n**Remediation Steps:**\n1. Verify the current version of the SiYuan container or executable.\n2. Pull the latest Docker image of SiYuan (v3.7.4+) or update the application binaries.\n3. Restart the service to apply the patch.\n4. If upgrading is delayed, configure Nginx or Caddy reverse proxies to return HTTP 403 for POST requests to `/api/attr/getBlockAttrs` and `/api/attr/batchGetBlockAttrs` from untrusted IP spaces.\n\n## References\n\n- [SiYuan Security Advisory GHSA-qvq9-hq6p-v378](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378)\n- [VulnCheck Security Advisory Page](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs)\n- [Official Patch Commit](https://github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72803) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T23:31:29.854308Z"}, {"uuid": "ebd1707d-2b93-472d-ae39-d99d5731d16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72803", "type": "seen", "source": "https://gist.github.com/alon710/6d84a03746a753dea4049dd4a31c2df7", "content": "# CVE-2026-72803: CVE-2026-72803: Information Disclosure via Missing Authorization in SiYuan API\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72803\n\n## Summary\nAn information disclosure vulnerability exists in the SiYuan personal knowledge management system versions prior to v3.7.4. The application fails to enforce publish-access filters on block attribute retrieval endpoints. Consequently, unauthenticated remote attackers can bypass document-level protection rules (such as password protection or disabled-publish flags) to retrieve sensitive block-level attributes, including aliases, memos, block names, and custom metadata fields, by querying the API using guessed or known block IDs.\n\n## TL;DR\nUnauthenticated remote attackers can bypass document-level protection rules (such as passwords or disabled-publish states) to read sensitive block metadata by directly querying the `getBlockAttrs` and `batchGetBlockAttrs` endpoints with known block IDs.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237 (0.237%)\n- **Impact**: Partial Confidentiality Loss\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later.\n- Restrict access to vulnerable API endpoints via reverse proxy rules.\n- Avoid storing highly sensitive credentials or text within block attributes.\n\n**Remediation Steps:**\n1. Verify the current version of the SiYuan container or executable.\n2. Pull the latest Docker image of SiYuan (v3.7.4+) or update the application binaries.\n3. Restart the service to apply the patch.\n4. If upgrading is delayed, configure Nginx or Caddy reverse proxies to return HTTP 403 for POST requests to `/api/attr/getBlockAttrs` and `/api/attr/batchGetBlockAttrs` from untrusted IP spaces.\n\n## References\n\n- [SiYuan Security Advisory GHSA-qvq9-hq6p-v378](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-qvq9-hq6p-v378)\n- [VulnCheck Security Advisory Page](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getblockattrs)\n- [Official Patch Commit](https://github.com/siyuan-note/siyuan/commit/229fdffd7e4afdef543d4d8495657fda8a369400)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72803) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T00:00:27.236655Z"}, {"uuid": "f40a4722-b277-4901-9265-a2a285682fa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72800", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5fhr-f75j-8wr9", "content": "", "creation_timestamp": "2026-09-04T00:35:03.645868Z"}, {"uuid": "77b00f3a-9ac8-4c19-afaf-d260c2af46fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72801", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8x84-r2ff-h8pq", "content": "", "creation_timestamp": "2026-09-04T00:35:05.877902Z"}, {"uuid": "d4155491-968a-4388-99c6-07a8a70428aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72802", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-jv8v-xq2h-657v", "content": "", "creation_timestamp": "2026-09-04T00:35:08.115237Z"}, {"uuid": "0c0ab12b-bf10-4dd7-94fa-acbed079c5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72803", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-qvq9-hq6p-v378", "content": "", "creation_timestamp": "2026-09-04T00:35:10.411655Z"}, {"uuid": "0c94295d-ee49-49b5-a180-50a0339c289c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72804", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-vpjw-wf5h-cgpq", "content": "", "creation_timestamp": "2026-09-04T00:35:12.646725Z"}, {"uuid": "ff2defae-3a40-45b3-8d08-b04073334f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72805", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-67x2-mq63-v9vm", "content": "", "creation_timestamp": "2026-09-04T00:35:19.984236Z"}, {"uuid": "9c5d24f3-2fe2-4db5-b939-285433c75fd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72806", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-6mcf-g667-w3qv", "content": "", "creation_timestamp": "2026-09-04T00:35:23.168261Z"}, {"uuid": "b78e3dc3-6945-412f-b2ec-da10db939dec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72807", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-x67c-8pwr-m8g3", "content": "", "creation_timestamp": "2026-09-04T00:35:25.406110Z"}, {"uuid": "be47da6b-1ce8-48cf-afff-a59f4de6361f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72808", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-v7ph-r5r6-4jcj", "content": "", "creation_timestamp": "2026-09-04T00:35:27.700629Z"}, {"uuid": "b431f12d-d76b-4398-ab6a-6c10cbd2cf18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72809", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-3mp7-4rh5-jrv9", "content": "", "creation_timestamp": "2026-09-04T00:35:29.931624Z"}, {"uuid": "8d538a7c-f1ca-4683-b25f-00b1f3e2f3e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72800", "type": "seen", "source": "https://gist.github.com/alon710/e7f11f4247b66892a17548a4438b01cd", "content": "# CVE-2026-72800: CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72800\n\n## Summary\nA security vulnerability in the SiYuan local-first personal knowledge management system allows unauthenticated remote attackers to bypass logical boundary controls in publish (read-only) mode. By interacting with endpoints that lack proper publish-access validation, an attacker can disclose the application's internal database schemas and harvest block IDs across both public and private notebooks. This metadata leakage compromises the confidentiality of restricted documents and provides foundational information for targeted extraction.\n\n## TL;DR\nMissing authorization checks in SiYuan's publish-mode API endpoints allow unauthenticated attackers to discover database schemas and private block IDs across the entire workspace.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 5.8 (Medium)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237\n- **EPSS Percentile**: 14.51%\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note-taking Application\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan deployments to version 3.7.4 or newer immediately.\n- Deploy reverse proxy rules to drop external traffic targeting sensitive api routes under /api/av/ and /api/block/.\n- Monitor application access logs for unexpected POST requests to missing middleware routes.\n\n**Remediation Steps:**\n1. Identify all internet-exposed SiYuan instances running in publish or read-only mode.\n2. Update the SiYuan application binaries or Docker containers to version 3.7.4.\n3. Verify that the POST /api/av/getAttributeViewKeysByID endpoint returns authorization errors for unauthenticated web requests.\n4. Restart the service and confirm proper access control behaviors.\n\n## References\n\n- [SiYuan GitHub Security Advisory GHSA-5fhr-f75j-8wr9](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5fhr-f75j-8wr9)\n- [VulnCheck Advisory for SiYuan Security Gaps](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-unfiltered-api)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72800) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T00:53:19.918989Z"}, {"uuid": "b57fed49-2f13-4aac-b3f0-d2817962bfc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72801", "type": "seen", "source": "https://gist.github.com/alon710/a6fd2dd8c86786415f62d46033a7b9e2", "content": "# CVE-2026-72801: CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72801\n\n## Summary\nAn access control vulnerability in the SiYuan personal knowledge management platform before version v3.7.4 exposes notebook encryption parameters to unauthenticated remote attackers. When the platform is configured in Publish Mode, specific API endpoints fail to enforce authorization checks. This access failure leaks key-derivation materials, password verifiers, and wrapped database keys to anonymous network clients.\n\n## TL;DR\nUnauthenticated endpoints in SiYuan before version v3.7.4 disclose Argon2id salts, cost parameters, password verifiers, and wrapped AES keys when Publish Mode is enabled. Attackers can leverage this material to execute high-speed, offline brute-force attacks to decrypt local notebook files.\n\n## Technical Details\n\n- **CWE ID**: CWE-522\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.7\n- **EPSS Score**: 0.00241 (Percentile: 15.12%)\n- **Impact**: Complete Cryptographic Information Disclosure\n- **Exploit Status**: No known public exploit\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management Platform\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Immediately upgrade SiYuan to version v3.7.4 or later\n- Disable the built-in Publish Mode feature if public sharing is not actively required\n- Configure reverse proxy rules to restrict access to administrative API endpoints\n- Rotate notebook master passwords to generate fresh cryptographic key material\n\n**Remediation Steps:**\n1. Check the running version of the SiYuan application by navigating to the system information panel\n2. Deploy the updated SiYuan v3.7.4 binary or pull the latest Docker container tag from the official repository\n3. If running behind Nginx, add a location block to return 403 Forbidden for unauthenticated paths matching /api/notebook/\n4. Change the master password for all notebooks that were published externally to invalidate any previously harvested keys\n\n## References\n\n- [GitHub Security Advisory GHSA-8x84-r2ff-h8pq](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8x84-r2ff-h8pq)\n- [VulnCheck Advisory for SiYuan Information Disclosure](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-encryption-key-material)\n- [CVE.org Record CVE-2026-72801](https://www.cve.org/CVERecord?id=CVE-2026-72801)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72801) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T03:02:58.239381Z"}, {"uuid": "e0570fbc-8f2d-4691-912d-1c5cf02b7b08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72802", "type": "seen", "source": "https://gist.github.com/alon710/be44b044fa32d940cf485868087a9fe9", "content": "# CVE-2026-72802: CVE-2026-72802: Sensitive Information Disclosure via Administrative Asset Resolvers in SiYuan Note\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72802\n\n## Summary\nSiYuan Note versions prior to v3.7.4 contain an information disclosure vulnerability in the `/api/asset/resolveAssetPath` endpoint. This endpoint returns absolute backend filesystem paths unmodified to CheckAuth-only requests. Low-privileged users or unauthenticated readers under publish mode can exploit this to leak the local directory layout, operating system username, and overall host deployment structure.\n\n## TL;DR\nAn authorization bypass through user-controlled keys in SiYuan Note allows unauthenticated readers to extract absolute local filesystem paths, exposing host usernames and operating system layout information.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note\n- **SiYuan**: < 3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or newer.\n- Incorporate Nginx or reverse proxy rules to block external access to administrative asset endpoints.\n- Temporarily disable publish mode to restrict anonymous read access.\n\n**Remediation Steps:**\n1. Identify the version of the currently running SiYuan Note instance.\n2. Download the v3.7.4 (or later) update package from the official repository.\n3. Stop the running container or application service.\n4. Deploy the updated binaries or pull the updated Docker image.\n5. Restart the SiYuan Note service.\n6. Validate the fix by sending a test POST request to `/api/asset/resolveAssetPath` using a low-privileged session and verify that the server returns an HTTP 403 Forbidden status.\n\n## References\n\n- [GitHub Security Advisory GHSA-jv8v-xq2h-657v](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jv8v-xq2h-657v)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-resolveassetpath)\n- [SiYuan Note Commit eee3410aa131b76f1bd72e933d484cf1ece77e88](https://github.com/siyuan-note/siyuan/commit/eee3410aa131b76f1bd72e933d484cf1ece77e88)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72802) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T03:32:06.317577Z"}, {"uuid": "e0598767-a3b0-4c2d-9ba5-f5ba1e5b2974", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72804", "type": "seen", "source": "https://gist.github.com/alon710/8322b53a1d7bba7f1109796c874a5f4c", "content": "# CVE-2026-72804: CVE-2026-72804: Authentication Bypass and Sensitive Information Exposure in SiYuan Graph Endpoints\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72804\n\n## Summary\nSiYuan before version 3.7.4 contains an authentication bypass vulnerability within its graph visualization API endpoints, allowing unauthenticated remote attackers to extract sensitive node metadata and content from password-protected documents.\n\n## TL;DR\nUnauthenticated remote attackers can query SiYuan's graph endpoints to bypass password protection and extract private document contents and linkages.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00255 (16.82%)\n- **Impact**: Confidentiality Exposure (High)\n- **Exploit Status**: PoC Available / Verified\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Knowledge Management Platform\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade to SiYuan version 3.7.4 or later to apply context-aware authorization controls.\n- Restrict external access to graph API endpoints using reverse proxies or Web Application Firewalls (WAF).\n- Mark sensitive documents as fully Hidden instead of Password Protected to use visibility-based logic on older versions.\n\n**Remediation Steps:**\n1. Pull the latest Docker image or update the SiYuan package to v3.7.4.\n2. Restart the SiYuan process or container.\n3. Configure reverse proxy block rules for `/api/graph/getGraph` and `/api/graph/getLocalGraph` if an immediate update is unfeasible.\n\n## References\n\n- [GitHub Security Advisory GHSA-vpjw-wf5h-cgpq](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vpjw-wf5h-cgpq)\n- [VulnCheck Intelligence Advisory](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-graph-endpoints)\n- [Patch Commit](https://github.com/siyuan-note/siyuan/commit/82e9ded423e45eabcc96010abd30c0f96bfe0323)\n- [NVD Portal](https://nvd.nist.gov/vuln/detail/CVE-2026-72804)\n- [CVE.org Portal](https://www.cve.org/CVERecord?id=CVE-2026-72804)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72804) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T04:32:14.300172Z"}, {"uuid": "9dc66400-ea4e-41b4-8730-fc21c842e4b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72805", "type": "seen", "source": "https://gist.github.com/alon710/4b6d07ad637cc3c13ae34977d7426539", "content": "# CVE-2026-72805: CVE-2026-72805: Missing Authorization in SiYuan Note Block APIs Leads to Information Disclosure\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72805\n\n## Summary\nSiYuan Note versions before v3.7.4 fail to enforce publish-access checks on several block API endpoints. This vulnerability allows anonymous readers or authorized accounts with low-privileged roles to retrieve sensitive document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying target block IDs.\n\n## TL;DR\nMissing publish-access checks in SiYuan Note block APIs allow unauthorized access to protected document content and layout metadata via direct API requests.\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-72805\n- **Weakness Class**: CWE-862 (Missing Authorization)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Attack Vector**: Network (AV:N)\n- **Exploit Status**: None (No public PoC or weaponized exploit)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan Note\n- **siyuan**: >= 0, < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or higher to enforce publish-access validation globally.\n- Deactivate Publish Mode entirely if notebooks are purely private.\n- Deploy reverse proxies (e.g., Nginx, Caddy) with HTTP authentication or IP address filtering.\n\n**Remediation Steps:**\n1. Identify all running self-hosted SiYuan Note instances.\n2. Check current application version via the user interface or container manifest.\n3. Pull the official v3.7.4 (or later) image or binary release.\n4. Apply the update and verify that restricted blocks are no longer accessible without proper authentication context.\n\n## References\n\n- [GitHub Security Advisory GHSA-67x2-mq63-v9vm](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vm)\n- [Official SiYuan Fix Commit](https://github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpoints)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T05:31:58.401028Z"}, {"uuid": "785ec440-2f47-4bd1-ad9c-587e616c5103", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72806", "type": "seen", "source": "https://gist.github.com/alon710/fbf800eaf7af09313d5329c1498b751c", "content": "# CVE-2026-72806: CVE-2026-72806: Missing Authorization in SiYuan Attribute View Rendering Leads to Information Disclosure\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72806\n\n## Summary\nAn authorization bypass vulnerability in SiYuan prior to v3.7.4 allows unauthenticated remote attackers to access rows, block IDs, and custom attributes of password-protected documents via the attribute view rendering endpoint.\n\n## TL;DR\nAn unauthenticated remote attacker can bypass password-protection policies on SiYuan documents by querying database attribute views, leading to sensitive data exposure.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.8 (Medium)\n- **EPSS Score**: 0.00307\n- **Impact**: Information Disclosure\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management platform\n- **SiYuan**: < v3.7.4 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Disable Publish Mode if not strictly necessary.\n- Deploy IP-based ACLs or VPN access to restrict access to the hosting server.\n- Explicitly add sensitive, password-protected documents to the publish-ignore list in vulnerable versions.\n\n**Remediation Steps:**\n1. Verify the current running version of the SiYuan instance.\n2. Download and install the update for SiYuan to version v3.7.4 or later.\n3. Verify that the backend rendering endpoint correctly prompts for a password when querying views containing protected documents.\n\n## References\n\n- [GitHub Security Advisory GHSA-6mcf-g667-w3qv](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv)\n- [SiYuan Fix Commit 768427f20f13bbd8dc4effa8aa4e1d09a7741bf4](https://github.com/siyuan-note/siyuan/commit/768427f20f13bbd8dc4effa8aa4e1d09a7741bf4)\n- [VulnCheck Advisory: SiYuan Authentication Bypass via Attribute View](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view)\n- [CVE Record: CVE-2026-72806](https://www.cve.org/CVERecord?id=CVE-2026-72806)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72806) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T06:33:11.208372Z"}, {"uuid": "2cde6466-633d-4e46-8e33-8b535c93bc32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72807", "type": "seen", "source": "https://gist.github.com/alon710/428fa3e523bd4efb06d0f15759388e47", "content": "# CVE-2026-72807: CVE-2026-72807: Second-Order SQL Injection via Attribute View Templates in SiYuan\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72807\n\n## Summary\nCVE-2026-72807 is a second-order SQL injection vulnerability in SiYuan versions prior to v3.7.4. It resides in the dynamic evaluation of Attribute View (AV) template columns, which expose unsafe template functions. An attacker can exploit this by distributing a malicious SiYuan package that executes arbitrary SQL queries on the victim's local database.\n\n## TL;DR\nUnauthenticated second-order SQL injection in SiYuan personal knowledge management system via malicious dynamic icon template rendering in Attribute Views.\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.8 (High)\n- **EPSS Score**: 0.00199 (Percentile: 9.77%)\n- **Exploit Status**: No public PoC\n- **CISA KEV Status**: Not Listed\n- **Impact**: Arbitrary read/write database access\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **siyuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version v3.7.4 or later immediately.\n- Inspect external .sy files and imported notebooks for dynamic Go templates containing SQL utility commands before importing.\n\n**Remediation Steps:**\n1. Identify all active installations of SiYuan in the environment.\n2. Verify the version is lower than 3.7.4.\n3. Download and apply the patch for version 3.7.4 or later from official channels.\n4. Configure import policies to prevent untrusted personal knowledge management packages from executing automatically.\n\n## References\n\n- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-x67c-8pwr-m8g3)\n- [https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template](https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-queryblocks-template)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72807) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T07:31:42.160368Z"}, {"uuid": "ef16b805-9c1b-4bb7-9b1a-695f58109eef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72808", "type": "seen", "source": "https://gist.github.com/alon710/4e3a59a46f5538004facf996eb24fc2d", "content": "# CVE-2026-72808: CVE-2026-72808: Unauthorized PDF Annotation Access in SiYuan Knowledge Management System\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72808\n\n## Summary\nAn information disclosure vulnerability in the SiYuan knowledge management system versions up to and including v3.7.2 allows remote unauthorized attackers to retrieve PDF annotations via the /api/asset/getFileAnnotation endpoint due to missing authorization checks.\n\n## TL;DR\nUnauthenticated or read-only users can bypass asset-level restrictions to retrieve sensitive PDF annotations from unpublished or password-protected documents.\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00283 (Percentile: 20.46%)\n- **Impact**: Information Disclosure (Access to PDF Annotations)\n- **Exploit Status**: No public functional exploit\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan\n- **SiYuan**: <= v3.7.2 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Restrict external access to the /api/asset/getFileAnnotation endpoint.\n- Upgrade SiYuan to version 3.7.4 or later.\n- Encrypt notebooks containing sensitive data.\n\n**Remediation Steps:**\n1. Analyze reverse proxy or server logs for requests to /api/asset/getFileAnnotation.\n2. Deploy network or reverse proxy rules to drop unauthorized access to API endpoints.\n3. Upgrade to SiYuan v3.7.4.\n4. Review active publish access settings and restrict public exposure of unpublished assets.\n\n## References\n\n- [GitHub Security Advisory (GHSA-v7ph-r5r6-4jcj)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v7ph-r5r6-4jcj)\n- [GitHub Commit 509b350](https://github.com/siyuan-note/siyuan/commit/509b35055940856ec1c89cb4888723c4660b776a)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getfileannotation)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72808) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T08:32:32.416346Z"}, {"uuid": "01e8833c-1f73-46bd-bc83-325e10ffd733", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72809", "type": "seen", "source": "https://gist.github.com/alon710/942448215c158ca42cd356ec66bc6d93", "content": "# CVE-2026-72809: CVE-2026-72809: Authentication Bypass in SiYuan via Localhost Trust Spoofing\n\n> **CVSS Score:** 8.0\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72809\n\n## Summary\nAn authentication bypass vulnerability exists in the SiYuan personal knowledge management system (versions <= v3.7.2). The flaw occurs because the kernel's authorization validation handler trusts loopback connection origins blindly, allowing remote network attackers to gain administrative privileges via an exposed local reverse proxy.\n\n## TL;DR\nSiYuan versions <= 3.7.2 contain an authentication bypass where the backend kernel automatically grants administrative privileges to any request routed through the local fixed-port proxy due to insecure localhost IP validation. Upgrading to version 3.7.4 resolves the issue.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-290\n- **Attack Vector**: Local / Network (dependent on proxy binding configuration)\n- **CVSS v3.1 Score**: 8.0\n- **CVSS Vector**: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system (versions <= v3.7.2)\n- **SiYuan**: <= v3.7.2 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or newer\n- Restrict the fixed-port reverse proxy binding address to localhost (127.0.0.1)\n- Implement network firewall rules to block external access to port 6806\n\n**Remediation Steps:**\n1. Identify active installations of SiYuan running versions <= v3.7.2\n2. Download the v3.7.4 or newer release package from the official repository\n3. Apply the update and restart the backend kernel service\n4. Verify the binding interface configuration of port 6806 to confirm it is not exposed on external interfaces\n5. Test endpoint access from an external node to verify that administrative APIs return HTTP 403 or redirect to login\n\n## References\n\n- [GitHub Security Advisory GHSA-3mp7-4rh5-jrv9](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3mp7-4rh5-jrv9)\n- [SiYuan Fix Commit](https://github.com/siyuan-note/siyuan/commit/9c16e9851f0b5d7ed179e5c2fca15a7724666871)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-localhost-trust)\n- [CVE-2026-72809 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-72809)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72809) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T09:32:48.633340Z"}]}