CVE-2026-72796 Overview
CVE-2026-72796 is a broken access control vulnerability in SiYuan, an open-source personal knowledge management application. Versions before v3.7.4 expose static-file routes in the server mux that bypass publish-access controls enforced on the REST API. Attackers holding publish reader tokens, or anonymous users when authentication is disabled, can read templates, snippets, and export artifacts by requesting static routes directly. The static route handlers do not enforce the same authorization checks as their REST API counterparts, resulting in unauthorized disclosure of workspace content. The issue is categorized under CWE-862: Missing Authorization.
Critical Impact
Unauthenticated or low-privileged remote attackers can read templates, snippets, and export files from a SiYuan instance without holding the credentials required by the REST API.
Affected Products
- SiYuan note-taking application versions prior to v3.7.4
- Deployments exposing the SiYuan server mux over the network
- Instances running in publish mode with reader tokens, or with authentication disabled
Discovery Timeline
- 2026-08-12 - CVE-2026-72796 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-72796
Vulnerability Analysis
SiYuan's HTTP server registers two classes of handlers: REST API endpoints and static-file routes served directly by the server mux. Publish mode is designed to expose a read-only, token-gated view of a workspace. Access control middleware validates publish reader tokens and enforces restrictions on API endpoints that return templates, snippets, and export artifacts.
The static-file routes bypass that middleware. Requests routed through the static handlers are served without evaluating the publish reader token scope or the disabled-auth mode restrictions. As a result, an attacker who reaches the server, whether through a valid reader token or anonymously against an instance with authentication disabled, can retrieve resources that the REST API would otherwise refuse.
Exploitation requires no user interaction and no elevated privileges. The disclosed material can include note templates, reusable snippets, and previously generated export archives, all of which may contain sensitive personal or business data stored in the workspace.
Root Cause
The root cause is inconsistent authorization enforcement across two parallel content-serving paths. The REST API paths apply publish-access checks; the static-file paths registered on the same mux do not. This mismatch produces a classic missing-authorization condition [CWE-862] where a protected resource is reachable through an unprotected route.
Attack Vector
The attack is executed over the network against the SiYuan HTTP listener. An attacker enumerates or guesses static routes that correspond to templates, snippets, or export artifacts and issues direct HTTP GET requests. When the target runs in publish mode, a reader-scoped token is sufficient; when the target runs with authentication disabled, no credential is required. The server responds with the requested file contents, disclosing information the REST API would have blocked. See the GitHub Security Advisory and the VulnCheck Advisory on Bypass for handler-level detail.
Detection Methods for CVE-2026-72796
Indicators of Compromise
- HTTP GET requests to SiYuan static-file routes serving templates, snippets, or export artifacts from external or unexpected client addresses
- Access log entries showing successful 200 responses on static routes from clients that never authenticate against the REST API
- Bursts of sequential requests enumerating template or export file paths
Detection Strategies
- Compare authentication events against static-route access to flag sessions that retrieve protected content without a prior REST API login
- Alert on anonymous access to static routes when the SiYuan instance is expected to be token-gated
- Correlate publish reader token usage with requests that fall outside the documented publish surface
Monitoring Recommendations
- Forward the SiYuan reverse-proxy or application access logs to a centralized log platform for retention and query
- Track the version banner of deployed SiYuan instances and alert when any node reports a version earlier than v3.7.4
- Monitor outbound data volume from the SiYuan host to detect bulk export retrieval
How to Mitigate CVE-2026-72796
Immediate Actions Required
- Upgrade all SiYuan instances to v3.7.4 or later
- Audit access logs for prior unauthorized retrieval of templates, snippets, and export artifacts
- Rotate publish reader tokens after upgrading to invalidate any tokens observed in suspicious sessions
- Restrict network exposure of the SiYuan server to trusted networks or an authenticated reverse proxy
Patch Information
The maintainers fixed the flaw in SiYuan v3.7.4 by applying publish-access enforcement to the static-file routes so they match the authorization behavior of the REST API. Refer to the GitHub Security Advisory GHSA-fgmr-7w36-9qfq for the fix commit and release notes.
Workarounds
- Place SiYuan behind a reverse proxy that enforces authentication on all paths, not only the REST API surface
- Disable publish mode until the upgrade to v3.7.4 is complete
- Do not run SiYuan with authentication disabled on any network-reachable interface
- Block external access to static-route prefixes used for templates, snippets, and exports at the proxy layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
