Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4
Siyuan Note users face 22 disclosed vulnerabilities, including authentication bypass and information disclosure flaws, patched in v3.7.4.
Key findings
- 22 vulnerabilities in Siyuan Note disclosed together on August 12, 2026, patched in v3.7.4.
- Multiple High severity flaws related to authentication bypass and information disclosure.
- Widespread failure to enforce publish-access controls across numerous API endpoints.
- Session cookie signing key and encrypted notebook key material exposed via configuration endpoints.
- SQL injection vulnerability found in attribute-view template columns.
- Encrypted notebooks improperly handled, allowing unauthenticated access to decrypted content.
On August 12, 2026, a significant batch of 22 vulnerabilities was disclosed for Siyuan Note, a popular note-taking application. These vulnerabilities, all patched in version v3.7.4, primarily revolve around authentication bypass and information disclosure flaws, with several carrying High severity ratings. The disclosures highlight a widespread issue with Siyuan Note's handling of publish-access controls and authentication checks across numerous API endpoints.
A major theme among these vulnerabilities is the failure to properly enforce publish-access controls. Multiple CVEs, including CVE-2026-72804, CVE-2026-72805, CVE-2026-72803, CVE-2026-72795, and CVE-2026-72788, detail how anonymous or unauthenticated users could access content from password-protected or hidden documents. This includes sensitive data such as block-level content, document titles, metadata, and even embedded block content. CVE-2026-72806 specifically points to a bypass in the FilterViewByPublishAccess filter, allowing access to password-protected document rows.
Another critical area of concern is the exposure of sensitive system and authentication information. CVE-2026-72794 and CVE-2026-72793 highlight the disclosure of the session cookie signing key through the /api/system/getConf endpoint, enabling attackers to forge session cookies and potentially gain administrative access. Furthermore, CVE-2026-72801 and CVE-2026-72793 mention the disclosure of encrypted notebook key-derivation material and wrapped data keys, which could facilitate offline master-password cracking. Information disclosure also extends to filesystem paths (CVE-2026-72802) and notebook metadata (CVE-2026-72790).
The batch also includes several authentication bypass vulnerabilities. CVE-2026-72809, rated High, allows any request with a loopback IP address to gain administrator privileges for specific endpoints. CVE-2026-72796 describes an access control bypass where static file routes bypass REST API publish-access controls, allowing direct access to sensitive files.
A notable vulnerability, CVE-2026-72789, addresses the improper handling of encrypted notebooks in publish mode, where they were treated as publicly accessible, allowing unauthenticated readers to access decrypted content. Additionally, CVE-2026-72807 introduces a second-order SQL injection vulnerability in attribute-view template columns due to the use of raw SQL instead of parameterized queries.
All 22 vulnerabilities were addressed in Siyuan Note version v3.7.4. Users are strongly advised to update to this version to mitigate the risks associated with these numerous security flaws. The widespread nature of these issues, particularly concerning access control and information exposure, underscores the importance of prompt patching for Siyuan Note users to protect their data and system integrity.
The coordinated disclosure of these 22 vulnerabilities on a single day highlights a significant security event for Siyuan Note users. The breadth of the issues, ranging from authentication bypass to SQL injection and extensive information disclosure, necessitates immediate attention. Users should prioritize updating to version v3.7.4 to secure their installations against these critical flaws. The consistent failure to enforce publish-access controls across various endpoints is a recurring pattern that users should be aware of when handling sensitive information within the application.