Is there a public PoC exploit available for CVE-2026-72797?

Yes, a public proof-of-concept exploit is available for CVE-2026-72797. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-72797?

Yes, a patch is available for CVE-2026-72797. Update the affected software to the latest version immediately.

SiYuan CVE-2026-72797

Q: What is the CVSS score of CVE-2026-72797?

CVE-2026-72797 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-57457 MEDIUM

Missing Authorization (CWE-862)

2026-08-12 VulnCheck

GHSA-f2rw-w22v-54vh

GHSA-rchc-g58m-88jm

Authentication Bypass Information Disclosure Siyuan Siyuan Note

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network endpoint, no auth or interaction required; confidentiality impact is low (metadata only), no integrity or availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:12 vuln.today

Patch available

Aug 12, 2026 - 20:03 EUVD

DescriptionCVE.org

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.

AnalysisAI

Unauthenticated information disclosure in SiYuan before v3.7.4 exposes encrypted notebook identifiers, names, and memory-resident unlock states via the getEncryptedNotebookStatus API endpoint without enforcing publish-access filtering. Any anonymous or publish-mode client that can reach the instance can enumerate the full list of encrypted notebooks and determine which are actively decrypted in server memory, leaking sensitive organizational metadata. No public exploit has been identified and no CISA KEV listing exists; a vendor-released patch is available in v3.7.4.

Technical ContextAI

SiYuan is a self-hosted personal knowledge management application (CPE: cpe:2.3:a:siyuan-note:siyuan:*:*:*:*:*:*:*:*) that supports encrypted, password-protected notebooks. The getEncryptedNotebookStatus backend API endpoint is designed to report the identifier, display name, and current decryption state (locked or unlocked in server memory) for each encrypted notebook. The root cause is CWE-862 (Missing Authorization): the endpoint executes and returns data without verifying that the requesting session holds publish-level or higher access. This is an authorization enforcement gap - authenticated admin sessions legitimately hold this data - but the server applies no access-tier check before serving the response, so anonymous callers in publish mode receive the identical output. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the endpoint is fully reachable over the network without credentials or attack preconditions.

RemediationAI

The primary fix is to upgrade SiYuan to version 3.7.4 or later, where the getEncryptedNotebookStatus endpoint enforces publish-access authorization filtering; see the vendor advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f2rw-w22v-54vh and the VulnCheck report at https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getencryptednotebookstatus. If an immediate upgrade is not feasible, disable publish mode if it is not operationally required - this removes anonymous access to the endpoint entirely without side effects on authenticated workflows. Alternatively, place the SiYuan instance behind a VPN or network-layer access control that prevents unauthenticated external HTTP access; note that this mitigates exposure but does not remediate the missing authorization logic and must be maintained independently of future configuration changes.