CVE-2026-72805

creationtimestamp| type| source ---|---|--- 2026-09-04 00:35:19+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-67x2-mq63-v9vm 2026-09-04 05:31:58+00:00| seen| https://gist.github.com/alon710/4b6d07ad637cc3c13ae34977d7426539...

CVE-2026-72805 SiYuan before v3.7.4 Information Disclosure via Block Endpoints

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block...