Information Disclosure in SiYuan by SiYuan Technology

CVE-2026-72797

What is CVE-2026-72797?

Versions of SiYuan prior to v3.7.4 are susceptible to an information disclosure vulnerability through the getEncryptedNotebookStatus endpoint. This flaw allows anonymous readers and accounts with publish-mode permissions to access sensitive details about encrypted notebooks. Specifically, it exposes encrypted notebook identifiers, names, and their respective lock states, which could enable unauthorized enumeration of all encrypted notebooks along with insights into their decryption status stored in memory, ironically compromising the confidentiality of user data.

References