CVE-2026-72806
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.
Risk Assessment
The risk is unauthorized access to sensitive data stored in protected documents, potentially leading to information leakage.
Recommendation
It is recommended to immediately upgrade SiYuan to version 3.7.4 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.