{"vulnerability": "cve-2026-72800", "sightings": [{"uuid": "f40a4722-b277-4901-9265-a2a285682fa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72800", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-5fhr-f75j-8wr9", "content": "", "creation_timestamp": "2026-09-04T00:35:03.645868Z"}, {"uuid": "8d538a7c-f1ca-4683-b25f-00b1f3e2f3e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72800", "type": "seen", "source": "https://gist.github.com/alon710/e7f11f4247b66892a17548a4438b01cd", "content": "# CVE-2026-72800: CVE-2026-72800: Missing Authorization in SiYuan Personal Knowledge Management System\n\n> **CVSS Score:** 5.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72800\n\n## Summary\nA security vulnerability in the SiYuan local-first personal knowledge management system allows unauthenticated remote attackers to bypass logical boundary controls in publish (read-only) mode. By interacting with endpoints that lack proper publish-access validation, an attacker can disclose the application's internal database schemas and harvest block IDs across both public and private notebooks. This metadata leakage compromises the confidentiality of restricted documents and provides foundational information for targeted extraction.\n\n## TL;DR\nMissing authorization checks in SiYuan's publish-mode API endpoints allow unauthenticated attackers to discover database schemas and private block IDs across the entire workspace.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (Unauthenticated)\n- **CVSS v3.1 Score**: 5.8 (Medium)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00237\n- **EPSS Percentile**: 14.51%\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Note-taking Application\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan deployments to version 3.7.4 or newer immediately.\n- Deploy reverse proxy rules to drop external traffic targeting sensitive api routes under /api/av/ and /api/block/.\n- Monitor application access logs for unexpected POST requests to missing middleware routes.\n\n**Remediation Steps:**\n1. Identify all internet-exposed SiYuan instances running in publish or read-only mode.\n2. Update the SiYuan application binaries or Docker containers to version 3.7.4.\n3. Verify that the POST /api/av/getAttributeViewKeysByID endpoint returns authorization errors for unauthenticated web requests.\n4. Restart the service and confirm proper access control behaviors.\n\n## References\n\n- [SiYuan GitHub Security Advisory GHSA-5fhr-f75j-8wr9](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5fhr-f75j-8wr9)\n- [VulnCheck Advisory for SiYuan Security Gaps](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-unfiltered-api)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72800) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T00:53:19.918989Z"}]}