Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck
CVE-2026-72795SiYuan before v3.7.4 Information Disclosure via Embed Block
High 8.6
In plain English
A high-severity missing authorization in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)0.3%top 76.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260725125659-1ca1c3c9d94b | GHSA-h6w7-xxcf-w2mq |
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260725125659-1ca1c3c9d94b | GO-2026-6425 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 0 – before 3.7.4 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-h6w7-xxcf-w2mq) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Embed Block third-party-advisory