CVE-2026-72789 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in SiYuan versions prior to 3.7.4 where the application fails to implement proper access control mechanisms for encrypted notebooks during the publishing process. The flaw stems from inadequate validation of publish permissions, causing the system to default to publicly accessible settings for encrypted content. When users attempt to publish encrypted notebooks through the API, the application does not verify whether the requester possesses valid authentication credentials or the necessary decryption keys before exposing document contents.
The technical implementation defect allows unauthorized access through the publish API endpoint where anonymous users can enumerate notebook structures and retrieve fully decrypted document content without providing any authentication tokens or cryptographic material. This represents a critical security oversight in the application's authorization model, as the system essentially treats all encrypted notebooks as if they were unencrypted when publishing operations are performed.
The operational impact of this vulnerability is significant as it enables attackers to harvest sensitive information from encrypted notebooks through automated enumeration techniques. The lack of proper access controls means that any individual with knowledge of the API endpoint can retrieve complete document contents, potentially exposing confidential data, personal information, or proprietary content stored within these encrypted repositories. This issue particularly affects organizations relying on SiYuan for secure document management and note-taking.
From a cybersecurity perspective, this vulnerability maps to CWE-284 Access Control Issues, specifically addressing insufficient access control validation during publish operations. The flaw also aligns with ATT&CK technique T1074 Data Staged, as it enables unauthorized data extraction through legitimate application interfaces. Additionally, it demonstrates poor privilege management and inadequate input validation in API endpoints that handle sensitive encrypted content.
The recommended mitigation strategy involves implementing proper authentication checks before allowing any publish operations on encrypted notebooks, ensuring that only authorized users with valid credentials can access the publish API. The system should validate user permissions against the notebook's encryption settings and require appropriate decryption keys or authentication tokens before exposing document contents. Updates to the application should include comprehensive access control validation for all publish endpoints and proper enforcement of encryption policies.
Security teams should immediately implement network-level restrictions to limit access to the publish API endpoints until the vulnerability is patched, while also monitoring for any unauthorized access attempts or data exfiltration activities. Organizations using SiYuan should conduct thorough audits of their encrypted notebook collections to identify potentially compromised content and ensure that all instances are updated to version 3.7.4 or later where proper access controls have been implemented to prevent anonymous enumeration and retrieval of decrypted document contents.