CVE-2026-72792
Fixed in a distro release EPSS <1%CVSS 5.8
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/tag/getTag endpoint that returns tag labels and occurrence counts from password-protected documents to unauthenticated readers. Attackers can enumerate tag vocabulary and internal terminology from password-protected documents by calling the tag endpoint without providing the document's publish password.
Products: siyuan-note siyuan
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260726002639-4515fa257cfa |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |