CVE-2026-72789 — SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retr…
Published: 2026-08-12 · CVSS: 9.2 · CVSS 4.0
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7