CVE-2026-72810 SiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket
Attackers can bypass publish boundaries via WebSocket to read password-protected and forbidden documents without authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72810?
CVE-2026-72810 is a critical missing authorization vulnerability in siyuan-note siyuan, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.
Weakness: CWE-862
Which versions are affected by CVE-2026-72810?
3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723013612-ba948639d7f6 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723013612-ba948639d7f6 |
github.com/siyuan-note/siyuan/kernel Go | All versions | 0.0.0-20260723013612-ba948639d7f6 |
How do I fix CVE-2026-72810?
Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260723013612-ba948639d7f6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72810 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72810 exists.
Sources
Also known as GHSA-mw8r-mw84-88v2, GO-2026-6400.