CVE-2026-72792 siyuan-note CVE debrief

Who should care

Users of SiYuan prior to v3.7.4, administrators of SiYuan installations, security teams monitoring for potential information disclosure vulnerabilities, and operators responsible for maintaining affected deployments should be aware of this vulnerability. They should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Additionally, they should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should also be checked for extra review, and exceptions, retest remediated assets, and close the item only after evidence is documented. Affected teams should track changes and verify patch deployment to ensure the vulnerability is properly addressed. Security teams should also consider the operational impact of this vulnerability on their organization and prioritize patching accordingly. The vulnerability's MEDIUM severity rating indicates that it should be addressed in a timely manner, but it may not be as critical as higher-severity vulnerabilities. However, it is still important to address this vulnerability to prevent potential information disclosure and minimize the attack surface. The CVE record and official advisory provide further details on the vulnerability and recommended actions. By prioritizing patching and taking proactive measures, organizations can reduce the risk associated with this vulnerability and protect their assets. It is also essential to review and update incident response plans to ensure they are prepared to handle potential exploitation of this vulnerability. Overall, a comprehensive approach to addressing this vulnerability is necessary to minimize its impact and prevent potential security breaches. The information provided in the CVE record and official advisory should be used to inform and prioritize patching efforts. By doing so, organizations can ensure they are taking proactive steps to protect their assets and prevent potential security breaches. The affected product and vulnerability class,

Technical summary

The /api/tag/getTag endpoint in SiYuan before v3.7.4 returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. This vulnerability could allow attackers to enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password. The affected product context suggests that organizations using SiYuan prior to v3.7.4 should prioritize patching to prevent potential information disclosure. The vulnerability has a CVSS score of 6.9 and a severity rating of MEDIUM.

Defensive priority

Organizations using SiYuan prior to v3.7.4 should prioritize patching to prevent potential information disclosure.

Recommended defensive actions

• Apply patches or updates to SiYuan to version v3.7.4 or later
• Restrict access to the /api/tag/getTag endpoint
• Monitor for suspicious activity related to the /api/tag/getTag endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-72792 record indicates an information disclosure vulnerability in SiYuan before v3.7.4, specifically in the /api/tag/getTag endpoint. This endpoint returns tag labels and occurrence counts from password-protected documents to unauthenticated readers, potentially allowing attackers to enumerate tag vocabulary and internal terminology.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.