https://vulnerability.circl.lu/sightings/feed 2026-09-12T12:29:18.938086+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/e9247a9d-7b7d-4051-88b7-5deadbdfb891/export 2026-09-12T12:29:18.965134+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e9247a9d-7b7d-4051-88b7-5deadbdfb891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://gist.github.com/alon710/eb15ac5c0e28dcec3fbc7013caed5d8c", "content": "# CVE-2026-72798: CVE-2026-72798: Missing Authorization and Information Disclosure in SiYuan renderAttributeView\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72798\n\n## Summary\nPrior to version v3.7.4, the SiYuan personal knowledge management system contained a critical logical authorization vulnerability within its database view rendering component. The flaws allowed unauthenticated remote attackers to bypass publish-access filters on databases, exposing sensitive Relation and Rollup cell contents belonging to private or password-protected repositories.\n\n## TL;DR\nMissing authorization checks in SiYuan renderAttributeView allow anonymous readers to bypass database access controls and extract sensitive cell data from hidden or password-protected databases via crafted API requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00256\n- **Exploit Status**: Proof-of-Concept / Theoretical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade the SiYuan personal knowledge management system to version v3.7.4 or newer\n- Enforce network boundaries by binding the local API server exclusively to localhost or protected interfaces\n- Minimize the use of public-facing relation columns that bridge public databases with private schemas\n\n**Remediation Steps:**\n1. Obtain the v3.7.4 release of SiYuan\n2. Verify the configured listen parameters in conf.json to ensure the system does not expose port 6806 publicly\n3. Deploy a secure, authenticated reverse proxy layer over any external instance access\n\n## References\n\n- [SiYuan Security Advisory GHSA-mfrj-v65r-979c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mfrj-v65r-979c)\n- [SiYuan Fix Commit 426991d](https://github.com/siyuan-note/siyuan/commit/426991d155c0c7c3a9e71badd6761eddfa8aad5b)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-renderattributeview)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72798) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T09:31:32.420102Z"} 2026-09-05T09:31:32.420102+00:00 https://vulnerability.circl.lu/sighting/0505f552-0439-4bde-9aa7-4c9f5611eac6/export 2026-09-12T12:29:18.967489+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "0505f552-0439-4bde-9aa7-4c9f5611eac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72798", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-mfrj-v65r-979c", "content": "", "creation_timestamp": "2026-09-04T22:35:16.386530Z"} 2026-09-04T22:35:16.386530+00:00 https://vulnerability.circl.lu/sighting/080b27d7-70fc-4ed9-97c2-7896b399dd2a/export 2026-09-12T12:29:18.968735+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "080b27d7-70fc-4ed9-97c2-7896b399dd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117088094869425518", "content": "CVE-2026-72798 - High severity info disclosure in SiYuan. Unpatched v3.7.4 lets anonymous readers access hidden database content via related-database bypass. CVSS 8.6. Update immediately. #CVE #SiYuan #infosec\nhttps://www.valtersit.com/cve/CVE-2026-72798/", "creation_timestamp": "2026-08-13T12:02:24.788069Z"} 2026-08-13T12:02:24.788069+00:00 https://vulnerability.circl.lu/sighting/06809748-6f40-4920-a572-20227f3186c6/export 2026-09-12T12:29:18.968889+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "06809748-6f40-4920-a572-20227f3186c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72798", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msxlwydfsb2k", "content": "CVE-2026-72798 - High severity info disclosure in SiYuan. Unpatched v3.7.4 lets anonymous readers access hidden database content via related-database bypass. CVSS 8.6. Update immediately. #CVE #SiYuan #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-72798/", "creation_timestamp": "2026-08-13T12:02:21.474270Z"} 2026-08-13T12:02:21.474270+00:00