CVE-2026-72804
Fixed in a distro release EPSS <1%CVSS 8.6
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.
Products: siyuan-note siyuan
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/siyuan-note/siyuan/kernel | 0.0.0-20260724091654-82e9ded423e4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |