{"vulnerability": "cve-2026-72808", "sightings": [{"uuid": "be47da6b-1ce8-48cf-afff-a59f4de6361f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72808", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-v7ph-r5r6-4jcj", "content": "", "creation_timestamp": "2026-09-04T00:35:27.700629Z"}, {"uuid": "ef16b805-9c1b-4bb7-9b1a-695f58109eef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72808", "type": "seen", "source": "https://gist.github.com/alon710/4e3a59a46f5538004facf996eb24fc2d", "content": "# CVE-2026-72808: CVE-2026-72808: Unauthorized PDF Annotation Access in SiYuan Knowledge Management System\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72808\n\n## Summary\nAn information disclosure vulnerability in the SiYuan knowledge management system versions up to and including v3.7.2 allows remote unauthorized attackers to retrieve PDF annotations via the /api/asset/getFileAnnotation endpoint due to missing authorization checks.\n\n## TL;DR\nUnauthenticated or read-only users can bypass asset-level restrictions to retrieve sensitive PDF annotations from unpublished or password-protected documents.\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00283 (Percentile: 20.46%)\n- **Impact**: Information Disclosure (Access to PDF Annotations)\n- **Exploit Status**: No public functional exploit\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan\n- **SiYuan**: <= v3.7.2 (Fixed in: `v3.7.4`)\n\n## Mitigation\n\n- Restrict external access to the /api/asset/getFileAnnotation endpoint.\n- Upgrade SiYuan to version 3.7.4 or later.\n- Encrypt notebooks containing sensitive data.\n\n**Remediation Steps:**\n1. Analyze reverse proxy or server logs for requests to /api/asset/getFileAnnotation.\n2. Deploy network or reverse proxy rules to drop unauthorized access to API endpoints.\n3. Upgrade to SiYuan v3.7.4.\n4. Review active publish access settings and restrict public exposure of unpublished assets.\n\n## References\n\n- [GitHub Security Advisory (GHSA-v7ph-r5r6-4jcj)](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v7ph-r5r6-4jcj)\n- [GitHub Commit 509b350](https://github.com/siyuan-note/siyuan/commit/509b35055940856ec1c89cb4888723c4660b776a)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getfileannotation)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72808) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T08:32:32.416346Z"}]}