CVE-2026-72800 siyuan-note CVE debrief

Who should care

Users of SiYuan versions before v3.7.4, administrators of SiYuan deployments, security teams monitoring for potential information disclosure vulnerabilities, and operators of affected systems should be aware of this vulnerability and take necessary actions to mitigate it.

Technical summary

SiYuan versions before v3.7.4 fail to apply publish-access filtering to certain endpoints, allowing authenticated readers to retrieve complete database column schemas and enumerate workspace-wide block IDs. This vulnerability has a CVSS score of 6.9 and is classified as MEDIUM severity. The affected product is SiYuan, and the vulnerability is related to improper access control. Attackers can leverage this vulnerability to gather sensitive information about the database schema and block IDs, which could be used to plan further exploitation.

Defensive priority

Medium priority due to the CVSS score of 6.9 and potential for information disclosure.

Recommended defensive actions

• Apply patches or updates to SiYuan to version v3.7.4 or later
• Restrict access to sensitive information and database column schemas
• Monitor for suspicious activity related to SiYuan deployments
• Implement compensating controls to limit the impact of potential exploitation
• Review and update asset inventory to identify potentially affected systems
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in SiYuan versions before v3.7.4. Limited information is available on the vendor's remediation efforts. The vulnerability allows authenticated readers to retrieve complete database column schemas and enumerate workspace-wide block IDs without publish scoping. Evidence is based on CVE and NVD entries, which may have limited detail. Defenders should verify affected SiYuan deployments, review vendor guidance, and monitor for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.