{"vulnerability": "cve-2026-72810", "sightings": [{"uuid": "08dc6247-fc17-4193-ad5a-e2e9507ad701", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72810", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mt2aqucjel2p", "content": "CVE-2026-72810 - siyuan\nVersions of SiYuan before 3.7.4 allow unauthorized users to access sensitive documents and real-time content updates without a password. This means that attackers can potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#siyuan #siyuannote #CVE #infosec", "creation_timestamp": "2026-08-14T13:20:04.241166Z"}, {"uuid": "52a17d49-cd29-42e5-b61b-0f0dd81ca202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-72810", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-mw8r-mw84-88v2", "content": "", "creation_timestamp": "2026-09-04T00:35:32.152699Z"}, {"uuid": "c77ee005-edaf-4fdc-b600-810c54a854a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72810", "type": "seen", "source": "https://gist.github.com/alon710/a4cc1353ab9f041fddf6785afea35431", "content": "# CVE-2026-72810: CVE-2026-72810: Publish-Boundary Bypass and Real-Time Data Leakage via WebSocket Session Pollution in SiYuan\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72810\n\n## Summary\nCVE-2026-72810 is a critical publish-boundary bypass vulnerability in the SiYuan personal knowledge management system before version 3.7.4. The flaw lies in the backend real-time WebSocket broadcast mechanism. When configured in public publish mode, the system fails to differentiate between unauthenticated public reader sessions and authorized administrative sessions within its global connection pool. This architectural oversight allows unauthenticated remote attackers connecting to the public WebSocket endpoint on port 6808 to passively receive real-time, raw workspace modification events, including keystroke logs, block updates, and content from protected or forbidden documents.\n\n## TL;DR\nA session-pollution flaw in SiYuan's WebSocket implementation allows anonymous network users to passively intercept all real-time workspace edits, bypassing publication boundaries.\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.6 (High)\n- **CVSS v4.0 Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00313 (0.313%)\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan personal knowledge management system\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade SiYuan to version 3.7.4 or later.\n- Restrict public network exposure to the WebSocket port (6808).\n- Configure reverse proxy rules to block unauthorized /ws handshakes.\n\n**Remediation Steps:**\n1. Verify the current running version of the SiYuan application.\n2. Pull and deploy the SiYuan container image or application binary for version 3.7.4 or later.\n3. Ensure firewall rules or security groups restrict access to administrative ports on public interfaces.\n4. Conduct a review of reverse-proxy rules to ensure WebSocket path /ws is protected.\n\n## References\n\n- [GitHub Security Advisory GHSA-mw8r-mw84-88v2](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mw8r-mw84-88v2)\n- [Third-Party Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/siyuan-before-publish-boundary-bypass-via-websocket)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72810) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-04T10:31:45.326661Z"}]}