CVE-2026-72804

SiYuan before v3.7.4 has an authentication bypass in the getGraph and getLocalGraph endpoints due to failure to validate the publish-password tier. This allows anonymous readers to retrieve block-level content of password-protected documents and view the complete reference topology without supply...

CVE-2026-72804

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

CVE-2026-72804 SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints

SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document...

EUVD-2026-30357

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POST /api/graph/getGraph, POST /api/graph/getLocalGraph, POST /api/sync/setSyncInterval, POST /api/storage/updateRecentDocViewTime, POST...