CVE-2026-72789
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Risk Assessment
Risk of exposing confidential content from encrypted notebooks to unauthorized parties.
Recommendation
Update SiYuan to version 3.7.4 or later, which fixes the validation of publish access for encrypted notebooks.
Original NVD description (English source)
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.