CVE-2026-72789 json
SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
published 2026-08-12 2 mo ago modified 2026-10-24 15 d ago also GHSA-v684-q882-jgmq , GO-2026-6434 , EUVD-2026-57449
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Patch / fix
- go github.com/siyuan-note/siyuan/kernel 0.0.0-20260726020813-a25c2dd06aae
- siyuan-note siyuan 3.7.4
- govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260916T180043-160000.1.1
suse advisories SUSE-SU-2026:23855-1SUSE-SU-2026:23863-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260916T180043-160000.1.1
opensuse advisories openSUSE-SU-2026:21897-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N |
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| CNA | 4.0 | 9.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| GitHub | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/siyuan-note/siyuan/kernel | <0.0.0-20260726020813-a25c2dd06aae |
0.0.0-20260726020813-a25c2dd06aae |
Affected products
- siyuan-note siyuan
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/siyuan-note/siyuan/commit/a25c2dd06aae13d1de70cc61cbf98169689c9d86
web
-
github.com
/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq
vendor-advisory, exploit, web, advisory
-
vulncheck.com
/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-72789
advisory
-
github.com
/siyuan-note/siyuan
package
Sources
- CVE List CVE-2026-72789
- GitHub Advisory GHSA-v684-q882-jgmq
- NVD CVE-2026-72789
- OSV GO-2026-6434
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.