CVE-2026-72804
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.
Risk Assessment
The risk includes unauthorized access to protected documents and disclosure of sensitive information.
Recommendation
It is recommended to update SiYuan to version v3.7.4 or later and implement proper authorization checks in the getGraph and getLocalGraph endpoints.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.