SiYuan CVE-2026-72796

Exploitation requires one of two conditions: (1) the SiYuan instance is running in disabled-auth mode, enabling fully anonymous network access to static routes, or (2) the attacker possesses a valid publish reader token for an otherwise-authenticated instance. In both cases the attacker must be able to reach the SiYuan server over the network. Exploitation is limited by: authentication being enabled and no token being available to the attacker; network-level controls preventing external access to the SiYuan port; and the scope of impact being confined to read-only access to templates, snippets, and export artifacts - write and delete operations are not exposed by this bypass.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects the most permissive exploitation path: anonymous network access against an instance running with authentication disabled. In that configuration no credential is required, complexity is low, and there are no attack-technique prerequisites. When authentication is enabled, exploitation requires a publish reader token (PR:L equivalent), which narrows the realistic attacker pool to holders of legitimately or illegitimately obtained tokens. The confidentiality impact is limited - only templates, snippets, and export artifacts are exposed; there is no indication of integrity or availability impact, and the vulnerable-system and subsequent-system impacts in the 4.0 vector are both set to Low. EPSS data was not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting exploitation has not been observed at scale. The practical risk level therefore depends heavily on deployment mode: instances with auth disabled and internet exposure are meaningfully at risk of data exposure, while instances requiring token-based access face a lower but non-negligible insider or token-theft risk. No conflicting signals between the CVSS vector and description were identified.

An attacker discovers a publicly reachable SiYuan instance operating in disabled-auth mode. Without any credentials, the attacker sends HTTP GET requests directly to static file-serving routes - bypassing the REST API's publish-access checks - and retrieves the workspace's templates, user snippets, and previously exported documents. No exploit code is publicly available at time of analysis, but the attack requires only standard HTTP tooling given the low complexity and no-auth conditions.