CVE-2026-72808

MEDIUM 5.8

SiYuan before v3.7.4 Information Disclosure via getFileAnnotation

CVSS Score

5.8

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.

CWE	CWE-862
Vendor	siyuan-note
Product	siyuan
Published	Aug 12, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new medium vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

siyuan-note / siyuan

0 < 3.7.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v7ph-r5r6-4jcj vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getfileannotation

Credits

🔍 Shirshakhtml