High severity8.6NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72795
CVE-2026-72795
Description
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260725125659-1ca1c3c9d94b | 0.0.0-20260725125659-1ca1c3c9d94b |
Affected products
1- Range: <3.7.4
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-h6w7-xxcf-w2mqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72795ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/1ca1c3c9d94bea14fc9728ff2fb8392bb0f29732ghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-h6w7-xxcf-w2mqnvdWEB
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-embed-blocknvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026