CVE-2026-72788
SiYuan before v3.7.4 Information Disclosure via UILayout Filter
CVSS Score
5.8
EPSS Score
0.0%
EPSS Percentile
0th
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.
| CWE | CWE-863 |
| Vendor | siyuan-note |
| Product | siyuan |
| Published | Aug 12, 2026 |
| Last Updated | Aug 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for siyuan-note siyuan
Be the first to know when new medium vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
siyuan-note / siyuan
0 < 3.7.4
References
Credits
🔍 Shirshakhtml