CVE-2026-72788 SiYuan before v3.7.4 Information Disclosure via UILayout Filter
Unauthenticated attackers can access administrator workspace state and private asset locations via the getConf endpoint in SiYuan.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72788?
CVE-2026-72788 is a medium-severity vulnerability in siyuan-note siyuan, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.
Weakness: CWE-863
Which versions are affected by CVE-2026-72788?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260812083335-251596fc0de2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260812083335-251596fc0de2 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260812083335-251596fc0de2 |
How do I fix CVE-2026-72788?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260812083335-251596fc0de2 or later.
Is CVE-2026-72788 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72788 exists.
Sources
Also known as GHSA-hgfg-j9pg-43xw, GO-2026-6622.