CVE-2026-74799 — SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers …
Published: 2026-08-17 · CVSS: 9.2 · CVSS 4.0
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7