Information Disclosure Vulnerability in SiYuan Note

CVE-2026-72801

What is CVE-2026-72801?

Certain versions of SiYuan Note, prior to v3.7.4, exhibit a significant information disclosure flaw where sensitive cryptographic material is unintentionally exposed via unauthenticated endpoints in publish mode. This vulnerability allows attackers to access crucial data such as the Argon2id salt, cost parameters, and password verifiers, as well as wrapped notebook keys. Consequently, an attacker may exploit this weakness for unlimited offline master-password cracking attempts, posing a severe risk to user data security.

References