CVE-2026-72804 Overview
CVE-2026-72804 is an authentication bypass vulnerability affecting SiYuan versions before v3.7.4. The flaw resides in the getGraph and getLocalGraph endpoints, which fail to validate the publish-password tier before returning data. Anonymous network attackers can invoke these endpoints without supplying a password and retrieve block-level content from password-protected documents. The response also exposes the complete reference topology, revealing how protected documents link to one another. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can read protected document content and map the internal knowledge graph of any exposed SiYuan instance.
Affected Products
- SiYuan note-taking application, all versions prior to v3.7.4
- Self-hosted SiYuan deployments exposing the HTTP API to untrusted networks
- SiYuan instances relying on publish-password protection for document confidentiality
Discovery Timeline
- 2026-08-12 - CVE-2026-72804 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-72804
Vulnerability Analysis
SiYuan supports password-protecting individual documents through a publish-password tier. Access to protected content should require the caller to present the correct password before the server returns block-level data. In vulnerable releases, the getGraph and getLocalGraph endpoints omit this authorization check. Both endpoints return block content and reference relationships used to render the document graph view. When called anonymously, the server serves the same content it would return to an authorized user. Attackers therefore bypass the publish-password control entirely and enumerate the underlying knowledge base. Details are documented in the SiYuan GitHub Security Advisory and the VulnCheck advisory.
Root Cause
The root cause is a missing authorization check on the graph endpoints. The publish-password tier is enforced elsewhere in the application, but the graph handlers do not consult it before returning block-level results. This is a broken access control pattern classified as [CWE-200].
Attack Vector
Exploitation requires only network reachability to the SiYuan HTTP interface. An attacker sends unauthenticated requests to the getGraph or getLocalGraph endpoints. The server returns the serialized graph, which contains block content and cross-document references. No user interaction, credentials, or prior access is required. The vulnerability is described in prose only because no verified proof-of-concept code has been published.
Detection Methods for CVE-2026-72804
Indicators of Compromise
- Unauthenticated HTTP POST requests to /api/graph/getGraph or /api/graph/getLocalGraph from external IP addresses
- Response payloads from graph endpoints served without a preceding authentication or password-check request in the same session
- Anomalous volumes of graph API calls from a single source enumerating multiple document identifiers
Detection Strategies
- Review web server and reverse proxy logs for requests to graph endpoints originating from sessions with no authentication cookies
- Correlate access patterns where graph API calls succeed but no preceding publish-password validation occurred
- Alert on external network sources reaching the SiYuan API when the instance is intended for internal use only
Monitoring Recommendations
- Enable verbose access logging on the SiYuan HTTP listener and forward logs to a centralized SIEM
- Track baseline request rates for /api/graph/* endpoints and alert on deviations
- Monitor egress from the SiYuan host for large outbound transfers that may indicate mass content extraction
How to Mitigate CVE-2026-72804
Immediate Actions Required
- Upgrade SiYuan to version v3.7.4 or later, which enforces the publish-password check on both graph endpoints
- Restrict network access to the SiYuan HTTP interface using firewall rules or a reverse proxy with authentication
- Audit publish-protected documents for sensitive content that may have already been exposed
Patch Information
The SiYuan maintainers addressed the missing authorization check in v3.7.4. The fix adds publish-password tier validation to the getGraph and getLocalGraph handlers before block content is serialized into the response. See the GHSA-vpjw-wf5h-cgpq advisory for the official remediation guidance.
Workarounds
- Place SiYuan behind a reverse proxy that requires authentication before forwarding requests to /api/graph/*
- Block external access to the SiYuan port and require VPN or tunnel access for remote users
- Remove sensitive content from SiYuan instances that cannot be immediately upgraded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
