GHSA-V7PH-R5R6-4JCJ SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)

🗓️ 03 Sep 2026 22:48:22Reported by GoogleType

osv🔗 osv.dev👁 2 Views

CVE: This vulnerability corresponds to CVE-2026-72808 . Summary The /api/asset/getFileAnnotation endpoint returns the content of .sya PDF-annotation files with no publish-access check. It is gated by CheckAuth only, so it is reachable by the publi...

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-72808	12 Aug 202619:07	–	attackerkb
Circl	CVE-2026-72808	4 Sep 202600:35	–	circl
CVE	CVE-2026-72808	12 Aug 202619:07	–	cve
Cvelist	CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation	12 Aug 202619:07	–	cvelist
EUVD	EUVD-2026-57409	3 Sep 202622:48	–	euvd
Github Security Blog	Duplicate Advisory: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)	12 Aug 202621:31	–	github
Github Security Blog	SiYuan: Missing publish-access filter on getFileAnnotation discloses private PDF annotations of forbidden/protected documents (publish mode)	3 Sep 202622:48	–	github
NVD	CVE-2026-72808	12 Aug 202620:17	–	nvd
Positive Technologies	PT-2026-71250	12 Aug 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation	12 Aug 202619:07	–	vulnrichment

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-v7ph-r5r6-4jcj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72808
github	www.github.com/siyuan-note/siyuan/commit/509b35055940856ec1c89cb4888723c4660b776a
github	www.github.com/siyuan-note/siyuan
vulncheck	www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getfileannotation

03 Sep 2026 23:01Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.15.8

EPSS0.00283