CVE-2026-72798 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in SiYuan versions prior to v3.7.4 where the renderAttributeView function fails to adequately filter database content related to hidden or password-protected databases. The flaw specifically affects the handling of Relation and Rollup cell contents, which are typically restricted from unauthorized access but can be retrieved by anonymous readers through crafted requests. The vulnerability stems from insufficient authorization checks during the rendering process, allowing attackers to exploit relationships between published and restricted databases to gain access to sensitive information that should remain protected.
The technical implementation flaw manifests in how SiYuan processes database relationships during view rendering operations. When a user accesses a published database that has relations to other databases, the system does not properly validate whether the requesting user has appropriate permissions to access the related database content. This creates an information disclosure pathway where attackers can construct requests that traverse these database relationships to retrieve data from hidden or password-protected databases. The vulnerability is particularly concerning because it operates at the rendering layer rather than the database access layer, making it more difficult to detect and prevent through traditional access control mechanisms.
The operational impact of this vulnerability extends beyond simple data exposure to potentially enable more sophisticated attacks. Attackers can systematically map out database relationships within a SiYuan instance and construct requests that bypass row-level filtering entirely when the first column contains non-block type data. This means that even databases with row-level security controls can be compromised, as the vulnerability allows access to entire database contents rather than just specific rows or cells. The attack surface is further expanded because anonymous users can exploit this without requiring authentication credentials, making it particularly dangerous for publicly accessible SiYuan installations.
This vulnerability aligns with CWE-284 Access Control Bypass and represents a significant deviation from the principle of least privilege in information security. The flaw directly contradicts the security principle that access to restricted resources should be strictly controlled based on user permissions and authentication status. From an ATT&CK perspective, this vulnerability maps to T1078 Valid Accounts and T1566 Phishing, as attackers could potentially use this to gain unauthorized access to sensitive data that would otherwise require proper authentication or authorization. The remediation approach requires implementing proper content filtering at the renderAttributeView level, ensuring that all related database content is properly validated against user permissions before being rendered for display.
The fix for this vulnerability involves implementing comprehensive access control checks within the renderAttributeView function to verify that users have appropriate permissions before rendering any related database content. This includes validating database access rights for all referenced databases in Relation and Rollup cells, implementing proper row filtering regardless of column types, and ensuring that anonymous users cannot bypass authentication requirements through database relationship traversal. Additionally, input validation should be strengthened to prevent malicious requests from exploiting these relationships and the system should maintain audit logs of database access attempts to detect potential exploitation attempts. The updated version v3.7.4 addresses these issues by implementing proper authorization checks at the rendering layer and ensuring that all related database content is properly filtered based on user permissions, aligning with industry standards for secure application development practices.