CVE-2026-72788 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The SiYuan note-taking application presents a critical information disclosure vulnerability affecting versions prior to v3.7.4 through a flaw in its UILayout filter implementation. This vulnerability stems from insufficient access control measures that permit unauthorized users to bypass authentication requirements when accessing sensitive workspace metadata. The technical weakness manifests specifically within the getConf endpoint which should enforce proper authorization checks but instead exposes administrative workspace state information to any unauthenticated requestor.
The operational impact of this vulnerability extends beyond simple data exposure as attackers can obtain comprehensive insights into administrator activities and system configuration. Through exploitation of this flaw, unauthorized parties gain access to open documents that may contain sensitive information, search terms that reveal user behavior patterns, notebook paths that map the organizational structure of content repositories, and private asset locations that could serve as targets for further exploitation. This comprehensive data leakage represents a significant compromise of system confidentiality and could enable attackers to craft more sophisticated attacks against the application or its users.
This vulnerability aligns with CWE-200, which addresses information exposure through improper access control mechanisms, and demonstrates a clear failure in implementing proper authentication checks before exposing administrative workspace state. The flaw operates at the application layer where security controls should have been enforced but were instead bypassed, creating an attack surface that violates fundamental security principles of least privilege and mandatory access controls. From an adversarial perspective, this vulnerability maps to ATT&CK technique T1083 (File and Directory Discovery) and T1566 (Phishing) as attackers can use the retrieved information to better target their operations or craft more convincing social engineering attacks.
The mitigation strategy requires immediate implementation of proper authentication enforcement for the getConf endpoint and related administrative functions. Organizations should upgrade to SiYuan version 3.7.4 or later where this vulnerability has been addressed through enhanced access control mechanisms. Additionally, administrators should implement network segmentation to limit exposure of the application to untrusted networks, deploy intrusion detection systems to monitor for unauthorized access attempts, and conduct regular security audits to identify similar access control flaws in other applications. The fix typically involves implementing robust session management, mandatory authentication checks before exposing administrative metadata, and proper input validation that prevents bypass attacks against the application's access control framework.