Medium severity5.8NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72788
CVE-2026-72788
Description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <v3.7.4
Patches
Vulnerability mechanics
References
2News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026