SiYuan CVE-2026-72806

Exploitation requires that the target SiYuan instance has the publish feature enabled and that the targeted documents or notebooks are configured with publish password protection - without the publish/sharing feature active, the vulnerable renderAttributeView path is not externally reachable. The instance must be accessible over the network to the attacker. No authentication to SiYuan itself is required, consistent with the CVSS 4.0 PR:N rating. Exploitation is bounded in scope: only attribute view data (titles, block IDs, column values of database rows) is exposed through this path; full document body content, file attachments, and server filesystem resources are not disclosed via this vulnerability. SiYuan instances with publish disabled, instances not network-accessible, and instances with no password-protected attribute view content are not affected.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N) correctly reflects a network-accessible, unauthenticated, low-complexity exposure with narrow confidentiality impact limited to attribute view row data. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be quantified. The absence of a CISA KEV listing and the lack of any identified public exploit code suggest this has not been broadly weaponized. Real-world risk is meaningfully bounded by the prerequisite that publish-with-password must be configured - instances not using the sharing feature are entirely unexposed. That said, even a mid-sized municipal IT team in leszno running a self-hosted SiYuan instance with password-protected shared notebooks would face genuine data leakage risk if sensitive structured data (project tracking, personnel records, financial rows) is stored in attribute views. The SC:L component in the provided CVSS 4.0 vector implies a downstream system impact, which is not clearly substantiated by the description; that metric may be conservative vendor scoring rather than confirmed behavior.

An unauthenticated attacker who identifies a publicly reachable SiYuan instance with publish sharing enabled sends a crafted HTTP request directly to the renderAttributeView API endpoint, omitting the publish password. Because FilterViewByPublishAccess does not invoke its password check on this path, the server returns attribute view row data - titles, block IDs, and column values - from documents the owner believed were password-gated. No public exploit code has been identified at time of analysis, but the attack requires only knowledge of the endpoint URL and network reachability.