PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72790 siyuan-note CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T20:17:50.407Z and has not been modified since then. The NVD entry is currently Deferred. This information disclosure vulnerability in SiYuan before v3.7.4 affects users with notebook deployments, as it allows unauthorized access to notebook metadata, potentially exposing sensitive information about notebook names, document counts, sizes, and timestamps for closed or non-published notebooks. Affected users should review and apply vendor remediation to protect their systems and data. Further verification is needed to confirm affected scope and severity due to limited source detail available.

Vendor
siyuan-note
Product
siyuan
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-12
Original CVE updated
2026-08-26
Advisory published
2026-08-12
Advisory updated
2026-08-26

Who should care

Users of SiYuan before v3.7.4, administrators of affected systems, security teams monitoring for potential information disclosure vulnerabilities, and operators responsible for maintaining notebook deployments should be aware of this vulnerability and take necessary precautions to protect their systems and data.

Technical summary

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint, allowing unauthorized access to notebook metadata. This could potentially expose sensitive information about notebook names, document counts, sizes, and timestamps for closed or non-published notebooks. The vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. Affected users should review and apply vendor remediation. The CVE record was published on 2026-08-12T20:17:50.407Z and has not been modified since then.

Defensive priority

Medium-priority defensive review recommended due to potential information disclosure vulnerability in SiYuan before v3.7.4.

Recommended defensive actions

  • Review and apply vendor remediation for SiYuan before v3.7.4
  • Inventory checks for affected SiYuan installations
  • Monitor for potential exploitation attempts
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates information disclosure vulnerability in SiYuan before v3.7.4. Limited source detail available. Further verification is needed to confirm affected scope and severity. Defensive review and inventory checks are recommended.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72790 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72790

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72790 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72790

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.