Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-72808SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

Medium 5.8

In plain English

A medium-severity missing authorization in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260723031702-509b35055940	GHSA-v7ph-r5r6-4jcj
Go	github.com/siyuan-note/siyuan/kernel	0.0.0-20260723031702-509b35055940	GO-2026-6406

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-v7ph-r5r6-4jcj) vendor-advisory
VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via getFileAnnotation third-party-advisory