Is there a patch available for CVE-2026-72791?

Yes, a patch is available for CVE-2026-72791. Update the affected software to the latest version immediately.

SiYuan CVE-2026-72791

Q: What is the CVSS score of CVE-2026-72791?

CVE-2026-72791 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-57451 MEDIUM

Missing Authorization (CWE-862)

2026-08-12 VulnCheck

GHSA-xf8j-hfm6-vc9v

Authentication Bypass Information Disclosure Siyuan Siyuan Note

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

CheckAuth middleware implies at minimum reader-level authentication (PR:L); impact is limited to structural metadata disclosure with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:11 vuln.today

Patch available

Aug 12, 2026 - 20:03 EUVD

DescriptionCVE.org

SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure - every view's name, icon, layout type, and per-field Hidden flag - for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.

AnalysisAI

Information disclosure in SiYuan v3.7.4-alpha.1 (pre-release only) permits any caller who passes basic authentication to retrieve complete database view metadata - including view names, icons, layout types, and per-field Hidden flags - for arbitrary database blocks by supplying an avID, regardless of their access level. The /api/av/getAttributeViewFieldViews endpoint introduced in commit acfc02ee8 applies CheckAuth middleware but omits any ownership or publish-access filter, producing a CWE-862 Missing Authorization condition. The vulnerability was corrected in the v3.7.4 stable release; no public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

SiYuan is an open-source, self-hosted personal knowledge management and note-taking application (CPE: cpe:2.3:a:siyuan-note:siyuan). The affected endpoint /api/av/getAttributeViewFieldViews was introduced exclusively in the v3.7.4-alpha.1 pre-release via commit acfc02ee8 and was never present in the stable v3.7.3 release or any prior stable branch. The endpoint is designed to return attribute view (AV) field view configurations - structural metadata describing database-style blocks within SiYuan notebooks. The CWE-862 (Missing Authorization) root cause is that the route enforces only the CheckAuth middleware, which verifies user identity but does not evaluate whether the authenticated caller has the access rights to read the specified database's view structure. This allows a low-privileged reader-role account to enumerate view configurations for any avID - including databases the reader has no legitimate access to - by sending direct API requests, bypassing the intended publish-access authorization boundary.

RemediationAI

Upgrade to SiYuan v3.7.4 stable, which is confirmed by the vendor to contain the fix for the missing authorization check on /api/av/getAttributeViewFieldViews. Users running v3.7.4-alpha.1 should treat this as a mandatory upgrade; users already on stable v3.7.3 or earlier require no action as the vulnerable endpoint was never shipped in a stable release. If an immediate upgrade is not possible for alpha users, restricting network access to the SiYuan API port (typically 6806) to trusted clients only via firewall rules or reverse-proxy authentication will prevent unauthenticated or unauthorized callers from reaching the endpoint. Full vendor advisory details are at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4.