CVE-2026-72788 siyuan-note CVE debrief

Who should care

Defenders and administrators using SiYuan Note should assess their exposure and verify the version being used to mitigate potential risks. This vulnerability can impact operators, platforms, vulnerability management, and security teams, making it essential to review and address the issue promptly.

Why it matters

CVE-2026-72788 is a vulnerability in SiYuan Note that discloses an administrator's open documents and search terms to anonymous readers. Defenders and administrators using SiYuan Note should assess their exposure and verify the version being used.

• An attacker can obtain the titles and identifiers of the administrator's open password-protected documents.
• An attacker can obtain the titles of documents in locked or closed notebooks.
• An attacker can obtain the administrator's recent search terms and the paths those searches were scoped to.
• An attacker can obtain the paths of private assets the administrator has open.

Technical summary

The vulnerability is caused by defects in `FilterConfByPublishIgnore`, which fails to properly filter the administrator's live workspace state, including open password-protected documents, locked or closed notebooks, recent search terms, and private assets. This allows an attacker to obtain sensitive information about the administrator's workspace. The vulnerability can be mitigated by verifying the version of SiYuan Note being used and assessing the impact of this vulnerability on systems, especially those using SiYuan Note.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially those using SiYuan Note.

Recommended defensive actions

• Verify the version of SiYuan Note being used and check if it is vulnerable.
• Assess the impact of this vulnerability on your systems, especially if you are using SiYuan Note.
• Consider updating to a fixed version of SiYuan Note, if available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by defects in `FilterConfByPublishIgnore`, which fails to properly filter the administrator's live workspace state, including open password-protected documents, locked or closed notebooks, recent search terms, and private assets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.