CVE-2026-72801 — SiYuan before v3.7.4 Information Disclosure via Encryption Key Material
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve…
Published: 2026-08-12 · CVSS: 8.7 · CVSS 4.0
SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline master-password cracking without rate limiting.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7