CVE-2026-72800 — SiYuan before v3.7.4 Information Disclosure via Unfiltered API
SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database colum…
Published: 2026-08-12 · CVSS: 6.9 · CVSS 4.0
SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate workspace-wide block IDs without publish scoping, enabling attackers to discover valid block identifiers across publish boundaries and access content from hidden or password-protected documents.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7