CVE-2026-72798 siyuan-note CVE debrief

Who should care

Users of SiYuan versions before v3.7.4, administrators of affected systems, security teams responsible for vulnerability management, and operators of platforms hosting SiYuan should be aware of this vulnerability. They should assess their exposure, review vendor guidance, and plan for remediation or mitigation. Security teams should monitor for suspicious activity and track exceptions to ensure the vulnerability is properly addressed. Vulnerability management and security teams should prioritize this vulnerability due to its critical severity and potential impact on sensitive content access.

Technical summary

CVE-2026-72798 affects SiYuan versions before v3.7.4, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases by requesting published databases related to restricted databases. The vulnerability has a CVSS score of 9.2 and is classified as CRITICAL. To mitigate, users should inventory and assess SiYuan installations for version v3.7.4 or later, restrict access to sensitive databases, and implement compensating controls.

Defensive priority

Critical vulnerability in SiYuan, allowing unauthorized access to sensitive content.

Recommended defensive actions

• Inventory and assess SiYuan installations for version v3.7.4 or later.
• Restrict access to sensitive databases and implement compensating controls.
• Monitor for suspicious activity and track exceptions.
• Apply vendor remediation when available.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-72798 record indicates that SiYuan versions before v3.7.4 are vulnerable to improper filtering of related-database content, potentially allowing unauthorized access to sensitive information. However, detailed information about the vulnerability and its impact is limited in the provided source corpus. To verify, defenders should review the official CVE record, assess affected SiYuan deployments, and monitor for suspicious activity. Evidence is limited, and further investigation is required to fully understand the vulnerability's scope and impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.