CVE-2026-72798
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.
Risk Assessment
The risk includes unauthorized access to sensitive data in hidden or protected databases, which could lead to information disclosure.
Recommendation
It is recommended to update SiYuan to version v3.7.4 or later and implement proper content filtering in renderAttributeView.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.