Medium severity5.8NVD Advisory· Published Aug 12, 2026· Updated Aug 26, 2026
CVE-2026-72799
CVE-2026-72799
Description
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader — or any publish reader token — can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/siyuan-note/siyuan/kernelGo | < 0.0.0-20260724112156-5bae0926b896 | 0.0.0-20260724112156-5bae0926b896 |
Affected products
1- Range: <=v3.7.2
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-5w7r-f4cg-rqq7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-72799ghsaADVISORY
- github.com/siyuan-note/siyuan/commit/5bae0926b896eaff0bc5cc6a75d421c2d161a806ghsaWEB
- github.com/siyuan-note/siyuan/security/advisories/GHSA-5w7r-f4cg-rqq7nvdWEB
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-path-resolutionnvdWEB
News mentions
1- Siyuan Note: 22 Vulnerabilities Disclosed Together, Patch Released in v3.7.4Vypr Intelligence · Aug 12, 2026