Pdf-Processing - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/pdf-processing/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 12 Aug 2026 20:54:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in SiYuan Publish APIhttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/Wed, 12 Aug 2026 20:54:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.SiYuan versions before 3.7.4 contain a critical authentication bypass vulnerability (CVE-2026-72789) within the application's publish API. The defect stems from an improper access control validation logic where encrypted notebooks are incorrectly treated as publicly accessible by default. When a user has unlocked an encrypted notebook, the application fails to verify the requestor's authorization, enabling anonymous remote users to enumerate and exfiltrate decrypted document content. This flaw allows attackers to bypass intended security boundaries without possessing the necessary encryption keys. Defenders should prioritize updating to v3.7.4 or later to remediate this improper authorization, which significantly exposes sensitive notebook data to unauthorized disclosure.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive, encrypted document content. Any notebook that has been unlocked by a user becomes vulnerable to retrieval by unauthenticated parties through the publish API. This impacts all SiYuan deployments currently running versions earlier than 3.7.4 that utilize the notebook publishing feature.

Recommendation

  • Update all SiYuan instances to version 3.7.4 or later immediately to patch the access control flaw.
  • Audit webserver access logs for high volumes of unexpected GET requests to the publish API endpoints from unauthorized IP addresses.
  • Disable the publish API feature temporarily if an immediate update to v3.7.4 is not feasible.
]]>criticaladvisoryaccess-controlweb-vulnerabilityauthentication-bypassinformation-disclosureapi-securityremote-code-executionvulnerabilitypdf-processingcredential-accessweb-application