CVE-2026-72797 siyuan-note CVE debrief

Who should care

Users of SiYuan versions before v3.7.4, administrators of SiYuan deployments, security teams monitoring for potential information disclosure vulnerabilities, and operators responsible for maintaining notebook deployments should be aware of this vulnerability. Affected organizations should prioritize patching to prevent potential information disclosure. Security teams should review compensating controls for exposed systems while remediation is scheduled and verified. Operators should track exceptions, retest remediated assets, and close the item only after evidence is documented. Platform and vulnerability-management teams should also review the affected scope and severity to ensure proper mitigation and follow-up. This vulnerability could have a significant impact on organizations relying on SiYuan for sensitive information management, making it essential to address promptly and thoroughly review affected deployments and plan for mitigation accordingly, considering potential operational impact and necessary defensive measures to protect sensitive notebook contents and maintain the security posture of affected systems and data accessed through SiYuan notebooks, especially in environments where sensitive information is stored or processed, to minimize potential risks and ensure the confidentiality and integrity of notebook data, and to prevent unauthorized access or exploitation of encrypted notebooks, which could lead to data breaches or other security incidents, emphasizing the need for prompt patching and thorough review of affected systems and deployments to ensure the security and integrity of sensitive information stored in SiYuan notebooks, and to prevent potential security risks associated with the information disclosure vulnerability in the getEncryptedNotebookStatus endpoint, organizations should consider implementing compensating controls, such as restricting access to the endpoint, monitoring for potential exploitation attempts, and maintaining an inventory of affected assets to ensure timely remediation and minimize potential impact on operations and data security, highlighting the importance of proactive measures to mitigate potential risks and keep,

Technical summary

The getEncryptedNotebookStatus endpoint in SiYuan versions before v3.7.4 returns encrypted notebook identifiers, names, and lock states without publish-access filtering. This allows unauthorized users to enumerate all encrypted notebooks and their current unlock status, potentially revealing sensitive information. The affected product, SiYuan, is a note-taking and knowledge management tool that handles encrypted notebooks. The vulnerability is caused by a lack of proper access controls on the getEncryptedNotebookStatus endpoint. Defensive impact is significant, as exploitation could lead to sensitive information disclosure. Source-grounded technical framing indicates that patching to version v3.7.4 or later is recommended.

Defensive priority

Organizations using SiYuan versions before v3.7.4 should prioritize patching to prevent potential information disclosure.

Recommended defensive actions

• Patch SiYuan to version v3.7.4 or later
• Restrict access to the getEncryptedNotebookStatus endpoint
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE-2026-72797 record indicates that SiYuan versions before v3.7.4 have an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint. This vulnerability allows anonymous readers and publish-mode accounts to enumerate all encrypted notebooks and their current unlock status, potentially revealing sensitive notebook names and decryption state in memory. The vendor and product information is not clearly stated, with the vendor listed as 'Unknown Vendor'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.