Authorization bypass in SiYuan encrypted notebook publish access gate (CVE-2026-72789)

SiYuan's publish-access gate uses an opt-out list (`publishAccess.json`) that is never populated with encrypted notebooks, causing the gate to treat all encrypted notebooks as publicly accessible by default. While an encrypted notebook is unlocked, an unauthenticated user in publish mode can enumerate notebooks, list their documents, and retrieve fully decrypted content. No key material, password, or cracking is required; the kernel decrypts and serves the data because the authorization layer does not check whether the notebook is encrypted. Affected versions: - eef105683 (v3.7.3, master HEAD) - verified unfixed at v3.7.4-alpha.1 We recommend updating to: v3.7.4. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq Details: https://vuln.today/cve/CVE-2026-72789