{"vulnerability": "ghsa-mfrj-v65r-979c", "sightings": [{"uuid": "a1a1d311-3af0-4c62-baee-4bd776182e62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-mfrj-v65r-979c", "type": "seen", "source": "https://gist.github.com/alon710/eb15ac5c0e28dcec3fbc7013caed5d8c", "content": "# CVE-2026-72798: CVE-2026-72798: Missing Authorization and Information Disclosure in SiYuan renderAttributeView\n\n> **CVSS Score:** 9.2\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72798\n\n## Summary\nPrior to version v3.7.4, the SiYuan personal knowledge management system contained a critical logical authorization vulnerability within its database view rendering component. The flaws allowed unauthenticated remote attackers to bypass publish-access filters on databases, exposing sensitive Relation and Rollup cell contents belonging to private or password-protected repositories.\n\n## TL;DR\nMissing authorization checks in SiYuan renderAttributeView allow anonymous readers to bypass database access controls and extract sensitive cell data from hidden or password-protected databases via crafted API requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862 (Missing Authorization)\n- **Attack Vector**: Network\n- **CVSS v4.0 Base Score**: 9.2 (Critical)\n- **EPSS Score**: 0.00256\n- **Exploit Status**: Proof-of-Concept / Theoretical Analysis\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Personal Knowledge Management System\n- **SiYuan**: < 3.7.4 (Fixed in: `3.7.4`)\n\n## Mitigation\n\n- Upgrade the SiYuan personal knowledge management system to version v3.7.4 or newer\n- Enforce network boundaries by binding the local API server exclusively to localhost or protected interfaces\n- Minimize the use of public-facing relation columns that bridge public databases with private schemas\n\n**Remediation Steps:**\n1. Obtain the v3.7.4 release of SiYuan\n2. Verify the configured listen parameters in conf.json to ensure the system does not expose port 6806 publicly\n3. Deploy a secure, authenticated reverse proxy layer over any external instance access\n\n## References\n\n- [SiYuan Security Advisory GHSA-mfrj-v65r-979c](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mfrj-v65r-979c)\n- [SiYuan Fix Commit 426991d](https://github.com/siyuan-note/siyuan/commit/426991d155c0c7c3a9e71badd6761eddfa8aad5b)\n- [VulnCheck Advisory](https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-renderattributeview)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72798) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T09:31:32.394681Z"}]}