CVE-2026-72800

creationtimestamp| type| source ---|---|--- 2026-09-04 00:35:03+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-5fhr-f75j-8wr9 2026-09-04 00:53:19+00:00| seen| https://gist.github.com/alon710/e7f11f4247b66892a17548a4438b01cd...

CVE-2026-72800 SiYuan before v3.7.4 Information Disclosure via Unfiltered API

SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText a...

CVE-2026-72800

SiYuan before v3.7.4 is affected by information-disclosure flaws due to missing publish-access filtering on getAttributeViewKeysByID, enabling authenticated readers to retrieve full database column schemas (descriptions, vocabularies, template expressions). Additionally, getBlockDefIDsByRefText a...