CVE-2026-72804
CRITICAL
CVSS 9.2
siyuan
Verified Advisory
Missing publish-password check in SiYuan graph API endpoints (CVE-2026-72804)
The `getGraph` and `getLocalGraph` endpoints in SiYuan filter document access by visibility tier only and never evaluate the publish password. Because password-protected documents are marked Visible = true, their nodes pass the filter unchanged, exposing per-block content and the complete reference/backlink topology to any caller holding a publish RoleReader token or to the anonymous account when publish authentication is disabled. This is materially broader than the by-design listing behavior, which exposes only document titles.
Affected versions:
- <=v3.7.2
We recommend updating to: v3.7.4.
CVSS 9.2 · our assessment: act_now
Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vpjw-wf5h-cgpq
Details: https://vuln.today/cve/CVE-2026-72804
Verified by vuln.today against published advisories.
Affected versions
- – <=v3.7.2
Fixed in: v3.7.4
More advisories for siyuan
- CVE-2026-73608 – Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)
- CVE-2026-72795 – Publish-access bypass in SiYuan embedded block endpoints (CVE-2026-72795)
- CVE-2026-72794 – Session cookie signing key disclosure in siyuan via getConf endpoint (CVE-2026-72794)
- CVE-2026-72798 – Information disclosure in SiYuan publish-mode attribute view filter (CVE-2026-72798)
- CVE-2026-72793 – Sensitive configuration disclosure in SiYuan via /api/system/getConf (CVE-2026-72793)
- CVE-2026-72789 – Authorization bypass in SiYuan encrypted notebook publish access gate (CVE-2026-72789)
- CVE-2026-68584 – Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)
- CVE-2026-68586 – Publish-access bypass in SiYuan backlink content endpoints (CVE-2026-68586)