EUVD-2026-57464

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72803

SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents by sending POST requests with block IDs...

EUVD-2026-57461

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline...

CVE-2026-72801

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline...

CVE-2026-72800

SiYuan before v3.7.4 is affected by information-disclosure flaws due to missing publish-access filtering on getAttributeViewKeysByID, enabling authenticated readers to retrieve full database column schemas (descriptions, vocabularies, template expressions). Additionally, getBlockDefIDsByRefText a...

CVE-2026-72799 SiYuan before v3.7.4 Information Disclosure via Path Resolution

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...

CVE-2026-72799

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...

EUVD-2026-57459

SiYuan before v3.7.4 affected =v3.7.2 fails to enforce publish-access filters on five filetree path-resolution endpoints getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. In publish mode, when Publish.Auth.Enable is false, an unauthenticated anonymous reader — or any...

CVE-2026-72799

CVE-2026-72799 affects SiYuan before v3.7.4 (up to v3.7.2). In publish mode, when Publish.Auth.Enable is false, unauthenticated readers or any publish reader token can call five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, getHPathByPath) to enum...

CVE-2026-72798

SiYuan prior to v3.7.4 is affected. In renderAttributeView, related-database content is not properly filtered, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can retrieve sensitive content by requesting published datab...

CVE-2026-72794 siyuan before v3.7.4 Session Cookie Key Disclosure via getConf

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

EUVD-2026-57454

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

CVE-2026-72794

CVE-2026-72794 affects Siyuan before v3.7.4. The vulnerability arises because the /api/system/getConf endpoint leaks the session cookie signing key to unauthenticated users in publish mode, enabling forgery of valid session cookies and potential user impersonation or administrative access. Affect...

CVE-2026-72794

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access...

EUVD-2026-57452

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-72792

SiYuan before version 3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that reveals tag labels and occurrence counts from password-protected documents to unauthenticated readers, enabling enumeration of vocabulary and internal terminology without the document...

CVE-2026-72792

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected...

CVE-2026-72791 SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews

SiYuan v3.7.4-alpha.1 a pre-release; the endpoint does not exist in stable v3.7.3 or earlier contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role...

CVE-2026-72790

SiYuan before v3.7.4 has an information disclosure in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization. Attackers can read notebook names, document counts, sizes, and timestamps for notebooks that are closed or not published. The disclosure is a meta...

EUVD-2026-57449

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication o...