Information Disclosure Vulnerability in SiYuan Document Management System

CVE-2026-72805

What is CVE-2026-72805?

A security lapse in SiYuan versions prior to v3.7.4 allows unauthorized users to access sensitive document information. Specifically, the failure to enforce publish-access checks on critical endpoints such as getBlockBreadcrumb, getRefText, and getBlockTreeInfos permits protection breaches. This vulnerability enables both anonymous users and RoleReader accounts with limited permissions to retrieve titles, content snippets, reference text, and path metadata from documents that should ideally remain secure, including publish-forbidden and password-protected documents. This oversight raises serious concerns about document confidentiality and the potential exposure of sensitive information.

References