High severity8.6NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72789
CVE-2026-72789
Description
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260726020813-a25c2dd06aae | 0.0.0-20260726020813-a25c2dd06aae |
Affected products
1- Range: <v3.7.4
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-v684-q882-jgmqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72789ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/a25c2dd06aae13d1de70cc61cbf98169689c9d86ghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmqnvdWEB
- www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooksnvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026