SiYuan CVE-2026-72810

The target SiYuan instance must have the publish surface enabled and network-reachable by the attacker; exploitation requires establishing a WebSocket connection to that publish broadcast endpoint. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and the attacker can passively receive events rather than actively triggering them. Exploitation is limited to instances running a version before v3.7.4 that actually expose the publish feature - a self-hosted deployment that never enables publishing, or one whose publish port is firewalled to trusted networks, is not reachable via this path. The disclosed data is bounded to content flowing through broadcast sessions during the attacker's connection window (real-time edits), including protected and forbidden documents.

The signals are largely consistent and point to real, easily realizable confidentiality risk: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with no user interaction, and VC:H/SC:H reflects high confidentiality impact extending beyond the immediately targeted data. Integrity and availability are untouched (VI/VA:N), so this is a pure disclosure bug, not RCE or DoS. EPSS was not provided and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation, and no POC was flagged in the source data - meaning exposure is currently theoretical-but-trivial rather than confirmed in-the-wild. The main limiter is deployment: only instances that actually expose the publish surface to untrusted networks are reachable, so a purely local or LAN-only self-host is far less exposed than an internet-facing publish endpoint, and any operator running an exposed publish surface should treat this as urgent given how little skill exploitation requires. Overall this is a genuine priority for exposed deployments and low-consequence for closed ones - verify your publish exposure before deprioritizing.

An attacker locates an internet-facing SiYuan publish surface and opens a WebSocket connection to its broadcast endpoint without supplying any credentials. As legitimate users edit their workspace, the attacker passively receives the live stream of content-change events - including from password-protected and forbidden documents - silently exfiltrating private notes with no interaction from the victim. The low attack complexity (AC:L) and lack of authentication (PR:N) make this reliably repeatable; no POC has been published, but the technique requires only a standard WebSocket client.