CVE-2026-72804 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
This vulnerability exists in SiYuan versions prior to v3.7.4 where the application fails to properly validate publish-password tiers when accessing graph data through getGraph and getLocalGraph endpoints. The flaw stems from inadequate input validation mechanisms that permit unauthorized access to password-protected document content by bypassing authentication requirements entirely. An attacker can exploit this weakness by directly calling these endpoints without providing the required password, thereby gaining read access to block-level content of protected documents along with the complete reference topology. This represents a critical authorization bypass vulnerability that violates fundamental security principles and allows for information disclosure of sensitive data.
The technical implementation flaw manifests as a missing authentication check within the graph retrieval endpoints, where the system should verify publish-password credentials before returning document content but instead processes requests regardless of authentication status. This vulnerability directly maps to CWE-285: Improper Authorization, which occurs when an application fails to properly enforce access controls for protected resources. The flaw enables attackers to harvest comprehensive document structures including internal references, cross-links, and hierarchical relationships that would normally be restricted to authorized users only.
Operationally this vulnerability poses significant risks to organizations using SiYuan as their primary documentation platform since it allows unauthorized reading of protected content without requiring any credentials or authentication mechanisms. Attackers can systematically enumerate protected documents and extract complete reference topologies, potentially exposing sensitive business information, internal processes, intellectual property, and document interdependencies. The impact extends beyond simple content disclosure to include potential reconnaissance activities that could reveal organizational structure, project relationships, and internal documentation patterns that adversaries might leverage for further attacks.
Organizations should immediately update their SiYuan installations to version 3.7.4 or later where the publish-password validation has been properly implemented. Additionally, system administrators should review access logs for any suspicious activity related to graph endpoints and consider implementing network-level restrictions to limit access to these specific API endpoints. The mitigation strategy should include enforcing proper authentication mechanisms and ensuring that all document access controls are validated at the application level before returning any protected content. This vulnerability demonstrates the critical importance of input validation and proper authorization checks in preventing unauthorized access to sensitive data within collaborative documentation platforms.
The attack surface for this vulnerability aligns with ATT&CK technique T1078: Valid Accounts, where adversaries can leverage weak authentication controls to access protected resources without requiring additional credential compromise. It also relates to T1566: Phishing for Information, as attackers might use this vulnerability to gather intelligence about organizational documentation structures and relationships. Security teams should implement monitoring for unauthorized access attempts to graph endpoints and establish proper access control policies that ensure all document content remains protected according to defined security classifications. The vulnerability highlights the necessity of comprehensive testing for authentication bypass scenarios in web applications and underscores the importance of validating all user inputs against expected authorization requirements before processing sensitive data requests.