vulnerability

CVE-2026-72789

NVD HIGH 8.6 · published 2026-08-12 · 1 on the wire

SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.

Exploited in the wild

Not on KEV

Not in CISA's Known Exploited Vulnerabilities catalogue as of the last daily pull. Absence is not proof of safety.

EPSS · 30-day forecast

Chance of exploitation in the next 30 days, 22th percentile of all CVEs. A forecast; KEV outranks it.

CVSS · NVD

8.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Internet exposure

—

No exposure census on this CVE's dispatches.

On the wire1

08 SepGHSA-v684-q882-jgmq: SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymoVULN

References

Early access

Watch this one?

Early access opens alerts first — one email when a CVE you follow lands on KEV or an adversary you follow lands on the wire. Nothing else, ever.

bot-protected