CVE-2026-72798 — SiYuan before v3.7.4 Information Disclosure via renderAttributeView
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents fro…
Published: 2026-08-12 · CVSS: 9.2 · CVSS 4.0
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7