{"vulnerability": "cve-2026-72805", "sightings": [{"uuid": "ff2defae-3a40-45b3-8d08-b04073334f23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72805", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-67x2-mq63-v9vm", "content": "", "creation_timestamp": "2026-09-04T00:35:19.984236Z"}, {"uuid": "9dc66400-ea4e-41b4-8730-fc21c842e4b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72805", "type": "seen", "source": "https://gist.github.com/alon710/4b6d07ad637cc3c13ae34977d7426539", "content": "# CVE-2026-72805: CVE-2026-72805: Missing Authorization in SiYuan Note Block APIs Leads to Information Disclosure\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72805\n\n## Summary\nSiYuan Note versions before v3.7.4 fail to enforce publish-access checks on several block API endpoints. This vulnerability allows anonymous readers or authorized accounts with low-privileged roles to retrieve sensitive document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying target block IDs.\n\n## TL;DR\nMissing publish-access checks in SiYuan Note block APIs allow unauthorized access to protected document content and layout metadata via direct API requests.\n\n## Technical Details\n\n- **Vulnerability ID**: CVE-2026-72805\n- **Weakness Class**: CWE-862 (Missing Authorization)\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **Attack Vector**: Network (AV:N)\n- **Exploit Status**: None (No public PoC or weaponized exploit)\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- SiYuan Note\n- **siyuan**: >= 0, < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan Note to version v3.7.4 or higher to enforce publish-access validation globally.\n- Deactivate Publish Mode entirely if notebooks are purely private.\n- Deploy reverse proxies (e.g., Nginx, Caddy) with HTTP authentication or IP address filtering.\n\n**Remediation Steps:**\n1. Identify all running self-hosted SiYuan Note instances.\n2. Check current application version via the user interface or container manifest.\n3. Pull the official v3.7.4 (or later) image or binary release.\n4. Apply the update and verify that restricted blocks are no longer accessible without proper authentication context.\n\n## References\n\n- [GitHub Security Advisory GHSA-67x2-mq63-v9vm](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-67x2-mq63-v9vm)\n- [Official SiYuan Fix Commit](https://github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-block-endpoints)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T05:31:58.401028Z"}]}