CVE-2026-72789 SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
Attackers can access decrypted content from encrypted notebooks via the publish API without authentication, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72789?
CVE-2026-72789 is a critical authentication bypass vulnerability in siyuan-note siyuan, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.
Weakness: CWE-862
Which versions are affected by CVE-2026-72789?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260726020813-a25c2dd06aae |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260726020813-a25c2dd06aae |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260726020813-a25c2dd06aae |
How do I fix CVE-2026-72789?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260726020813-a25c2dd06aae or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72789 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72789 exists.
Sources
Also known as GHSA-v684-q882-jgmq, GO-2026-6434.