PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72809 siyuan-note CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-12T20:17:53.110Z and has not been modified since then. CVE-2026-72809 is an authentication bypass vulnerability in SiYuan versions <= v3.7.2, patched in v3.7.4. The vulnerability exists in the kernel's CheckAuth function, which grants the administrator role to requests from loopback (127.0.0.1) for specific endpoints. A remote unauthenticated attacker could potentially exploit this via a fixed-port reverse proxy bound to a network interface, although end-to-end reproduction was not confirmed. Users of SiYuan versions <= v3.7.2, administrators of affected systems, and security teams responsible for vulnerability management should be aware of this HIGH-severity vulnerability and apply the patch promptly.

Vendor
siyuan-note
Product
siyuan
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-12
Original CVE updated
2026-08-26
Advisory published
2026-08-12
Advisory updated
2026-08-26

Who should care

Users of SiYuan versions <= v3.7.2, administrators of affected systems, and security teams responsible for vulnerability management should be aware of this HIGH-severity vulnerability and apply the patch promptly.

Technical summary

CVE-2026-72809 is an authentication bypass vulnerability in SiYuan versions <= v3.7.2, patched in v3.7.4. The vulnerability exists in the kernel's CheckAuth function, which grants the administrator role to requests from loopback (127.0.0.1) for specific endpoints. A remote unauthenticated attacker could potentially exploit this via a fixed-port reverse proxy bound to a network interface, although end-to-end reproduction was not confirmed.

Defensive priority

CVE-2026-72809 is rated HIGH with a CVSS score of 7.1; apply defensive measures promptly.

Recommended defensive actions

  • Verify and apply the vendor-provided patch (v3.7.4) to address the authentication bypass vulnerability.
  • Review and restrict access to the affected endpoints (/api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*).
  • Configure the fixed-port reverse proxy to inject an authentication token or limit its scope to localhost only.
  • Monitor for suspicious requests to the affected endpoints, especially those originating from loopback addresses.
  • Consider implementing additional compensating controls, such as IP restrictions or multi-factor authentication.

Evidence notes

The CVE-2026-72809 vulnerability affects SiYuan versions <= v3.7.2, patched in v3.7.4. An authentication bypass exists in the kernel's CheckAuth function for specific endpoints when requests originate from loopback (127.0.0.1). A remote unauthenticated attacker could exploit this via a fixed-port reverse proxy bound to a network interface, potentially gaining admin access. However, end-to-end reproduction of this forwarding behavior was not confirmed.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72809 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72809

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72809 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72809

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.