CVE-2026-72808 SiYuan before v3.7.4 Information Disclosure via getFileAnnotation
Attackers can read private PDF annotations from protected documents via an API endpoint lacking proper access checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72808?
CVE-2026-72808 is a medium-severity missing authorization vulnerability in siyuan-note siyuan, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Because the endpoint is gated only by CheckAuth (unlike the /assets/* route, which enforces publish access and password), an anonymous reader (when publish authentication is disabled) or any publish RoleReader who knows an asset path can read the private PDF annotations (highlights and notes) of publish-forbidden, password-protected, or unpublished documents. The issue is limited to non-encrypted notebooks; encrypted-box annotations are not exposed.
Weakness: CWE-862
Which versions are affected by CVE-2026-72808?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723031702-509b35055940 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723031702-509b35055940 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723031702-509b35055940 |
How do I fix CVE-2026-72808?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260723031702-509b35055940 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72808 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72808 exists.
Sources
Also known as GHSA-v7ph-r5r6-4jcj, GO-2026-6406.