CVE-2026-72804

creationtimestamp| type| source ---|---|--- 2026-09-04 00:35:12+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-vpjw-wf5h-cgpq 2026-09-04 04:32:14+00:00| seen| https://gist.github.com/alon710/8322b53a1d7bba7f1109796c874a5f4c...

CVE-2026-72804

SiYuan before v3.7.4 has an authentication bypass in the getGraph and getLocalGraph endpoints due to failure to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and view the complete reference topology without supply...

CVE-2026-72804 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...