Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck
CVE-2026-72799SiYuan before v3.7.4 Information Disclosure via Path Resolution
Medium 5.8
In plain English
A medium-severity missing authorization in siyuan from siyuan-note. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Auth.Enable is false, an unauthenticated (anonymous) reader — or any publish reader token — can call these endpoints to enumerate the complete private document tree, mapping notebook names, folder hierarchies, and document titles, and resolving title paths to document IDs, including for documents marked hidden, password-protected, or publish-forbidden.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260724112156-5bae0926b896 | GHSA-5w7r-f4cg-rqq7 |
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260724112156-5bae0926b896 | GO-2026-6412 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | 0 – before 3.7.4 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-5w7r-f4cg-rqq7) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Path Resolution third-party-advisory