critical advisory August 12, 2026

Authentication Bypass in SiYuan Publish API

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

What's new

1. added CVE-2026-72807 +3 Sep 8, 20:05 via ghsa
2. added detection rule: Detects CVE-2026-77086 Exploitation - Path Traversal in Bazaar Endpoints Aug 21, 11:23 via nvd
3. added coverage for SiYuan (<= 3.7.3) Aug 19, 14:33 via nvd
4. added coverage for SiYuan Aug 18, 12:52 via nvd
5. added coverage for SiYuan (< 3.7.4) Aug 18, 12:52 via nvd

SiYuan versions before 3.7.4 contain a critical authentication bypass vulnerability (CVE-2026-72789) within the application's publish API. The defect stems from an improper access control validation logic where encrypted notebooks are incorrectly treated as publicly accessible by default. When a user has unlocked an encrypted notebook, the application fails to verify the requestor's authorization, enabling anonymous remote users to enumerate and exfiltrate decrypted document content. This flaw allows attackers to bypass intended security boundaries without possessing the necessary encryption keys. Defenders should prioritize updating to v3.7.4 or later to remediate this improper authorization, which significantly exposes sensitive notebook data to unauthorized disclosure.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive, encrypted document content. Any notebook that has been unlocked by a user becomes vulnerable to retrieval by unauthenticated parties through the publish API. This impacts all SiYuan deployments currently running versions earlier than 3.7.4 that utilize the notebook publishing feature.

Recommendation

Update all SiYuan instances to version 3.7.4 or later immediately to patch the access control flaw.
Audit webserver access logs for high volumes of unexpected GET requests to the publish API endpoints from unauthorized IP addresses.
Disable the publish API feature temporarily if an immediate update to v3.7.4 is not feasible.

Immediate actions

Upgrade SiYuan to version 3.7.4

IT Operations 48h

Mitigations

Disable publish API

immediate IT Operations

CVE-2026-72789

Detection coverage 7

Detect SiYuan Brute-Force Attempts via CheckAuth

high

Detects potential brute-force activity against SiYuan /api/ endpoints by monitoring for an excessive volume of 401 Unauthorized responses

sigma tactics: credential_access techniques: T1110.001 sources: webserver

Detect CVE-2026-73045 Exploitation - Brute Force on authFilePublishAccess

medium

Detects potential brute-force activity against the SiYuan authFilePublishAccess endpoint by monitoring for high-frequency POST requests.

sigma tactics: credential_access techniques: T1110.001 sources: webserver

Detect Unauthenticated Access to SiYuan Debug Endpoints

high

Detects unauthorized HTTP requests to SiYuan debug endpoints associated with CVE-2026-74799

sigma tactics: reconnaissance techniques: T1592 sources: webserver

Detect Potential CVE-2026-74800 Exploitation - Malicious Asset Upload

high

Detects potential exploitation of CVE-2026-74800 by monitoring for HTML file uploads to the SiYuan asset management path.

sigma tactics: initial_access techniques: T1190, T1505 sources: webserver

Detect Excessive 401 Unauthorized Responses to SiYuan Publish Service

high

Detects potential brute-force activity against the SiYuan Publish Service by monitoring for high frequencies of 401 Unauthorized responses on TCP port 6808.

sigma tactics: credential_access techniques: T1110.001 sources: webserver

Detect Potential Exploitation of CVE-2026-74904 - SiYuan Unauthorized Block Access

high

Detects unauthorized access attempts to SiYuan block API endpoints associated with CVE-2026-74904.

sigma tactics: reconnaissance sources: webserver

Detects CVE-2026-77086 Exploitation - Path Traversal in Bazaar Endpoints

high

Detects attempts to use path traversal sequences in the packageName parameter during Bazaar install or uninstall operations.

sigma tactics: persistence techniques: T1059 sources: webserver

Detection queries are available on the platform. Get full rules →

Affected

Vendors

SiYuan

Products

SiYuan < 3.7.4

SiYuan <= 3.7.2

SiYuan <= 3.7.3

Operating systems

WindowsLinuxmacOS

CVEs

8.6 0.29%

8.0 0.20%

9.0 0.23%

9.8 0.43%

9.1 0.65%

CPE identifiers

siyuan:siyuan

CPE identifiers

siyuan:siyuan

References

MITRE ATT&CK

T1592 · TA0001

Gather Victim Org Information

Initial Access

high

Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.

T1552 · TA0006

Unsecured Credentials

Credential Access

high

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key.

T1068 · TA0004

Exploitation for Privilege Escalation

Privilege Escalation

high

Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.

T1187 · TA0004

Forced Authentication

Privilege Escalation

high

Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.

T1592 · TA0009

Gather Victim Org Information

Collection

high

Attackers can request published blocks containing embed queries to read content from password-protected, hidden, or forbidden documents without authorization.

T1592 · TA0006

Gather Victim Org Information

Credential Access

high

Attackers can call these endpoints without supplying a password to read protected document content and the complete reference topology.

T1204 · TA0001

User Execution

Initial Access

high

Attackers can distribute malicious SiYuan documents or packages with crafted template columns that execute arbitrary SQL on a victim's kernel when the package is imported and rendered.

T1059.003 · TA0002

Command and Scripting Interpreter: Windows Command Shell

Execution

high

The application utilizes the queryBlocks function, which improperly handles raw SQL via string substitution, enabling arbitrary SQL execution.

T1190 · TA0001

Exploit Public-Facing Application

Initial Access

high

The flaw is reachable by an anonymous or RoleReader user on the publish surface.

T1505.004 · TA0002

Server Software Component: SQL Injection

Execution

high

An attacker can execute arbitrary SQL, enabling cross-notebook read and write.

T1203 · TA0001

Exploitation for Client Execution

Initial Access

high

Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF.

T1059 · TA0002

Command and Scripting Interpreter

Execution

high

Attackers can inject markup through field descriptions or names that close containing elements and execute arbitrary code via event handlers, reaching Node built-ins due to Electron's insecure configuration.

T1110 · TA0006

Brute Force

Credential Access

high

This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel.

T1059.007 · TA0002

Command and Scripting Interpreter: JavaScript

Execution

high

Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases

T1592 · TA0007

Gather Victim Host Information

Discovery

high

Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider API keys.

T1189 · TA0001

Drive-by Compromise

Initial Access

high

Attackers can craft a malicious filename containing script payloads that execute with full OS command access when a user drags, drops, or pastes the file into the editor.

T1592 · TA0007

Gather Victim Org Information

Discovery

high

allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace.

T1595.002 · TA0007

Active Scanning: Vulnerability Scanning

Discovery

high

This is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure.

T1059 · TA0003

Command and Scripting Interpreter

Persistence

high

Attackers with admin access can write arbitrary files to any location via install operations

CVE search metadata

What's new

Impact

Recommendation

Immediate actions

Mitigations

Detection coverage 7