{"uuid": "cfb418a7-8d99-4c02-aa84-2526be534d22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fgmr-7w36-9qfq", "type": "seen", "source": "https://gist.github.com/alon710/78668aa7363409db44eada4d30afb2b9", "content": "# CVE-2026-72796: CVE-2026-72796: Access Control Bypass via Static Routes in SiYuan\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72796\n\n## Summary\nA detailed technical breakdown of CVE-2026-72796 (GHSA-fgmr-7w36-9qfq), an access control bypass vulnerability in the SiYuan personal knowledge management system. Prior to version 3.7.4, inconsistent authorization checks between dynamic API endpoints and static file routes allowed authenticated low-privilege readers or anonymous public users to read sensitive files, templates, snippets, and export directories.\n\n## TL;DR\nInconsistent authorization controls in SiYuan prior to v3.7.4 permitted low-privilege or anonymous readers to bypass REST API security filters and download sensitive templates, snippets, widgets, and ZIP backups by accessing their static routes directly.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network\n- **CVSS Score**: 5.8 (Medium)\n- **EPSS Score**: 0.00257 (17.14th percentile)\n- **Impact**: Confidentiality\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n\n## Mitigation\n\n- Upgrade to SiYuan version 3.7.4 or later to enforce administrative controls on static templates and exports.\n- Enable dynamic Markdown-AST-based asset validation to restrict public file reads to actively linked resources.\n- Isolate the self-hosted application behind a reverse proxy or VPN to prevent public access to server ports.\n\n**Remediation Steps:**\n1. Identify all running SiYuan instances and record their current version numbers.\n2. For Docker-based instances, execute 'docker pull b3log/siyuan:v3.7.4' to download the patched container image.\n3. Stop the existing container and launch the new container using the updated image tag while maintaining volume mappings.\n4. Verify that requests to static endpoints such as '/templates/' return 403 Forbidden for non-administrative users.\n\n## References\n\n- [GitHub Security Advisory GHSA-fgmr-7w36-9qfq](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fgmr-7w36-9qfq)\n- [SiYuan Fix Commit 34be6c0](https://github.com/siyuan-note/siyuan/commit/34be6c0bb0739d5b8e99ecc0cbfb474abb16230d)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72796) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T21:32:38.770310Z"}