CVE-2026-72810
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SiYuan before v3.7.4 contains a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.
Risk Assessment
Unauthorized individuals can access sensitive content that should be protected, compromising data confidentiality and potentially leading to information leakage.
Recommendation
Upgrade SiYuan to version v3.7.4 or later and enforce authentication for WebSocket connections.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.