CVE-2026-72797

SiYuan prior to v3.7.4 contains an information-disclosure vulnerability in the getEncryptedNotebookStatus endpoint. The endpoint returns encrypted notebook identifiers, names, and lock states without publish-access filtering, allowing anonymous readers and publish-mode accounts to enumerate all e...