CVE-2026-72797 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability resides within the SiYuan note-taking application ecosystem where version v3.7.4 and earlier implementations exhibit a critical information disclosure weakness in the getEncryptedNotebookStatus endpoint. This flaw represents a direct violation of access control mechanisms that should normally restrict sensitive notebook metadata to authorized users only. The endpoint failure occurs because it indiscriminately returns encrypted notebook identifiers, names, and lock states without implementing proper publish-access filtering controls. Such a design oversight creates an information leakage scenario where unauthorized parties can gain visibility into the internal structure of encrypted notebook collections.
The technical implementation flaw stems from inadequate input validation and access control enforcement within the application's authentication and authorization framework. When anonymous readers or publish-mode accounts make requests to the getEncryptedNotebookStatus endpoint, the system fails to verify whether these users possess sufficient privileges to access the requested metadata. This weakness manifests as a complete breakdown in the principle of least privilege, where sensitive operational data becomes accessible through legitimate API endpoints. The vulnerability specifically affects encrypted notebook environments where the application maintains memory states indicating whether notebooks are currently unlocked or locked, thereby exposing decryption status information to unauthorized entities.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks targeting encrypted notebook collections. Attackers can enumerate all available encrypted notebooks within the system, gaining knowledge of sensitive notebook names that may contain confidential information. This enumeration capability allows for targeted reconnaissance activities where threat actors can identify high-value targets based on notebook naming conventions and lock states. The exposure of decryption status in memory creates additional attack surface where adversaries might attempt to exploit timing attacks or memory analysis techniques to infer encryption keys or other cryptographic parameters. From a compliance perspective, this vulnerability directly conflicts with security standards such as those outlined in cwe-200 which addresses information disclosure vulnerabilities.
Mitigation strategies should prioritize immediate implementation of access control restrictions on the getEncryptedNotebookStatus endpoint, ensuring that only authenticated users with appropriate permissions can access encrypted notebook metadata. The system must enforce proper authentication checks before returning any notebook identifiers or lock status information, particularly for publish-mode accounts that should not have visibility into the complete encrypted notebook collection. Security measures should include implementing role-based access controls that differentiate between read-only publish mode users and administrative accounts with full notebook access capabilities. Additionally, the application should maintain audit logs of all requests to this endpoint to detect unauthorized access attempts. Organizations should also consider implementing rate limiting and monitoring mechanisms to identify potential enumeration attacks targeting this specific vulnerability. The fix aligns with attack techniques categorized under initial access and reconnaissance phases in the ATT&CK framework, where adversaries seek to understand system configurations before planning more targeted exploitation activities.