SiYuan CVE-2026-72797

Exploitation requires network-level reachability to a SiYuan instance that accepts unauthenticated HTTP requests - most directly achieved when publish mode is enabled, which allows anonymous read access to shared content and makes the getEncryptedNotebookStatus endpoint reachable without credentials. The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms no authentication, no user interaction, and no special attack prerequisites are needed once network access exists. Exploitation is limited by deployment context: instances accessible only via localhost, behind a VPN, behind an authenticating reverse proxy, or with publish mode disabled are not reachable by anonymous callers and are not practically exploitable regardless of the missing authorization logic. No specific browser, client library, or configuration parameter beyond publish-mode exposure is required.

The CVSS 4.0 score of 6.9 reflects a genuine ease-of-access/limited-impact profile: the endpoint is network-reachable, requires zero authentication, and imposes no complexity on the attacker, but the exposed data is metadata only - notebook names and unlock states, not notebook content or credentials. The SC:L (subsequent-system confidentiality: low) metric acknowledges that the leaked unlock state may inform further attacks against other components. No EPSS score was provided, no CISA KEV listing exists, and no POC exploit code was referenced, collectively indicating this has not seen documented widespread or automated exploitation. Real-world risk is meaningfully elevated for SiYuan instances exposed to the internet with publish mode enabled, where notebook metadata could reveal sensitive organizational structure or active decryption patterns and enable targeted follow-on reconnaissance. Instances deployed on isolated networks, behind authentication proxies, or without publish mode enabled face substantially reduced exposure. No conflicting signals were identified in the available data.

An attacker identifies a publicly reachable SiYuan instance running in publish mode and sends a single unauthenticated HTTP GET request to the getEncryptedNotebookStatus API endpoint. The server responds with a complete list of encrypted notebook identifiers, human-readable names, and their current decryption states, requiring no credentials, tokens, or session cookies. The attacker uses the leaked notebook names to identify high-value targets and the unlock-state data to infer when sensitive notebooks are actively in use, informing timing or social engineering for a follow-on attack.