CVE-2026-72798: SiYuan Information Disclosure Vulnerability

CVE-2026-72798 Overview

CVE-2026-72798 is an information disclosure vulnerability in SiYuan, an open-source personal knowledge management application. Versions prior to v3.7.4 fail to properly filter related-database content in the renderAttributeView function. Anonymous readers can access Relation and Rollup cell contents from hidden or password-protected databases through published databases that reference restricted data. Attackers can also bypass row filtering when the first column is a non-block type. The vulnerability is categorized as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated remote attackers can retrieve sensitive content from hidden or password-protected SiYuan databases without any user interaction.

Affected Products

SiYuan versions before v3.7.4
SiYuan published database instances exposing Relation columns
SiYuan published database instances with non-block first columns

Discovery Timeline

2026-08-12 - CVE-2026-72798 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72798

Vulnerability Analysis

SiYuan's attribute view system supports Relation and Rollup columns that reference data stored in other databases. When a client requests a published database, the server invokes renderAttributeView to build the response payload. The function retrieves referenced data from related databases but does not verify whether the anonymous requester is authorized to view those source databases.

As a result, an attacker who accesses any published database that relates to a hidden or password-protected database can read the referenced Relation and Rollup cell contents. A second flaw bypasses row-level filtering entirely when the first column of an attribute view is a non-block type, exposing rows that should remain hidden.

Root Cause

The root cause is missing authorization enforcement in renderAttributeView when resolving cross-database references. The function trusts the relationship metadata and returns cell content without re-checking access controls on the source database. Row filtering logic additionally assumes the first column is a block type, so non-block first columns silently disable the filter.

Attack Vector

Exploitation requires network access to a SiYuan instance that exposes at least one published database. The attacker sends crafted requests to the published attribute view endpoint. No authentication, privileges, or user interaction are required. See the GitHub Security Advisory and the VulnCheck Advisory for reference details.

Detection Methods for CVE-2026-72798

Indicators of Compromise

Anonymous HTTP requests targeting SiYuan attribute view rendering endpoints associated with published databases
Response payloads containing Relation or Rollup content sourced from databases marked hidden or password-protected
Unusual volume of requests enumerating published database identifiers from a single client

Detection Strategies

Inspect application access logs for unauthenticated calls to renderAttributeView and correlate them with published database identifiers
Compare response contents against database visibility settings to identify leaks of restricted Relation or Rollup fields
Alert on published attribute views whose first column is a non-block type, since these instances are susceptible to filter bypass

Monitoring Recommendations

Enable verbose HTTP access logging on the SiYuan service and forward logs to a centralized analytics platform for retention and search
Baseline typical anonymous request patterns for published databases and alert on statistical deviations
Review published database configurations regularly to confirm no sensitive Relation targets or non-block first columns remain exposed

How to Mitigate CVE-2026-72798

Immediate Actions Required

Upgrade SiYuan to version v3.7.4 or later on all self-hosted and shared instances
Audit all published databases and unpublish any that reference hidden or password-protected sources
Rotate or reclassify secrets that may have been exposed through Relation or Rollup cells

Patch Information

The SiYuan maintainers fixed the flaw in v3.7.4 by enforcing authorization checks on related-database content within renderAttributeView and correcting row filtering when the first column is a non-block type. Refer to the GitHub Security Advisory GHSA-mfrj-v65r-979c for full remediation details.

Workarounds

Disable database publishing until the upgrade to v3.7.4 is complete
Remove Relation and Rollup columns from any published attribute views that reference restricted databases
Restructure attribute views so the first column is a block type to preserve row-level filtering

bash

# Verify installed SiYuan version and upgrade if below v3.7.4
siyuan --version
# Then download and install the patched release from the official SiYuan repository