CVE-2026-72788

medium

Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.

References

https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-uilayout-filter

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hgfg-j9pg-43xw

https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-57448

Details

Source: Mitre, NVD

Published: 2026-08-12

Updated: 2026-10-24

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.00413