CVE-2026-72796 — SiYuan before v3.7.4 Access Control Bypass via Static Routes
SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attacker…
Published: 2026-08-12 · CVSS: 6.9 · CVSS 4.0
SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifacts by directly accessing static routes that lack the same restrictions as their REST API counterparts.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7