CVE-2026-72792 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The SiYuan note-taking application version 3.7.3 and earlier contains a critical information disclosure vulnerability within its /api/tag/getTag endpoint that fundamentally undermines the security of password-protected documents. This vulnerability represents a direct violation of access control mechanisms designed to protect sensitive content, allowing unauthorized users to bypass authentication requirements and extract structured metadata from protected documents. The flaw manifests specifically when attackers make requests to the tag enumeration endpoint without providing the necessary document publish password, thereby exposing internal tagging vocabulary and occurrence statistics that should remain confidential.
This security weakness falls under the CWE-200 category of "Information Exposure" and more specifically aligns with CWE-352, "Cross-Site Request Forgery," as it enables unauthorized data extraction through API endpoints that should require proper authentication. The vulnerability operates at the application layer where proper access controls fail to validate user credentials before returning sensitive metadata. From an operational perspective, this flaw creates a significant risk for organizations relying on SiYuan for storing confidential information, as attackers can systematically enumerate tag vocabularies and internal terminology patterns from protected documents without possessing the actual document content or password.
The impact of this vulnerability extends beyond simple information leakage, as it enables threat actors to perform reconnaissance activities that could inform more sophisticated attacks. By accessing tag labels and occurrence counts, attackers gain insights into organizational structure, content categorization strategies, and potentially sensitive business terminology that could be leveraged for social engineering or targeted attacks. This represents a violation of the principle of least privilege, where the system fails to properly enforce access controls for metadata extraction operations.
From a mitigation standpoint, the primary solution involves implementing proper authentication checks before returning tag information from password-protected documents. The endpoint should validate user credentials and verify document access permissions before executing the tag enumeration process. Security controls should include mandatory authentication tokens or session validation for all tag-related API calls, ensuring that only authorized users with legitimate access to specific documents can retrieve tag metadata. Organizations should also implement rate limiting on tag enumeration endpoints to prevent automated enumeration attacks, while monitoring for unusual patterns of tag data access that may indicate exploitation attempts.
The vulnerability demonstrates a classic example of insecure direct object reference where the system fails to properly validate user authorization before providing access to document metadata. This aligns with ATT&CK technique T1213.002 "Data from Information Repositories" as attackers can systematically extract structured data from protected repositories without proper authorization. The remediation approach should involve comprehensive access control reviews and implementation of proper authentication flows for all metadata extraction endpoints, ensuring that tag vocabulary and occurrence statistics remain protected within their intended security boundaries. Organizations using SiYuan should immediately update to version 3.7.4 or later where this vulnerability has been addressed through enhanced authentication requirements for tag enumeration operations.