Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-72805— SiYuan before v3.7.4 Information Disclosure via Block Endpoints

Quick assessment

Affected

siyuan-note siyuan

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SiYuan是SiYuan团队开源的一款文档管理软件。 SiYuan 3.7.4之前版本存在授权问题漏洞，该漏洞源于未对getBlockBreadcrumb、getRefText和getBlockTreeInfos端点强制执行发布访问检查，可能导致匿名读者或publish RoleReader账户通过提供块ID披露受保护文档的标题、内容片段、引用文本和路径元数据。

CVSS 5.8 · Medium EPSS 0.33% · P23 Updated Aug 15, 2026

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 2

Vendor	Product	Version Range	Status
siyuan-note	siyuan	`< 3.7.4`	affected
		`3.7.4`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72805

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SiYuan before v3.7.4 Information Disclosure via Block Endpoints

Source: CVE Program / CVE List V5

Vulnerability Description

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Vulnerability Title

SiYuan 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
siyuan-note	siyuan	0 ~ 3.7.4	-

II. Public POCs for CVE-2026-72805

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-72805

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-72805 (1)

🔗 Missing publish-access check on getBlockBreadcrumb, getRefText, and getBlockTreeInfos discloses content and metadata of protected/forbidden documents (publish mode) · Advisory · siyuan-note/siyuan · GitHub Read full article vendor-advisory

Other References for CVE-2026-72805 (1)

🔗 SiYuan before v3.7.4 Information Disclosure via Block Endpoints | Advisories | VulnCheck third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-72805

Same Patch Batch · siyuan-note · 2026-08-12 · 22 CVEs total

CVE-2026-72793	8.6 HIGH	SiYuan before v3.7.4 Information Disclosure via /api/system/getConf
CVE-2026-72804	8.6 HIGH	SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
CVE-2026-72789	8.6 HIGH	SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
CVE-2026-72798	8.6 HIGH	SiYuan before v3.7.4 Information Disclosure via renderAttributeView
CVE-2026-72794	8.6 HIGH	siyuan before v3.7.4 Session Cookie Key Disclosure via getConf
CVE-2026-72795	8.6 HIGH	SiYuan before v3.7.4 Information Disclosure via Embed Block
CVE-2026-72809	8.0 HIGH	SiYuan before v3.7.4 Authentication Bypass via Localhost Trust
CVE-2026-72807	8.0 HIGH	SiYuan before v3.7.4 SQL Injection via queryBlocks template
CVE-2026-72801	7.5 HIGH	SiYuan before v3.7.4 Information Disclosure via Encryption Key Material
CVE-2026-72796	5.8 MEDIUM	SiYuan before v3.7.4 Access Control Bypass via Static Routes
CVE-2026-72806	5.8 MEDIUM	SiYuan before v3.7.4 Authentication Bypass via Attribute View
CVE-2026-72791	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews
CVE-2026-72788	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via UILayout Filter
CVE-2026-72803	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via getBlockAttrs
CVE-2026-72790	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via getNotebookInfo
CVE-2026-72808	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
CVE-2026-72797	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus
CVE-2026-72792	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via Tag API
CVE-2026-72799	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via Path Resolution
CVE-2026-72800	5.8 MEDIUM	SiYuan before v3.7.4 Information Disclosure via Unfiltered API

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: siyuan

Same vendor: siyuan-note

Same weakness: CWE-862

V. Comments for CVE-2026-72805

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-72805— SiYuan before v3.7.4 Information Disclosure via Block Endpoints

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 2

I. Basic Information for CVE-2026-72805

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-72805

III. Intelligence Information for CVE-2026-72805

Vendor Advisories for CVE-2026-72805 (1)

Other References for CVE-2026-72805 (1)

Same Patch Batch · siyuan-note · 2026-08-12 · 22 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-72805

Leave a comment