CVE-2026-72806: SiYuan before v3.7.4 Authentication Bypass via Attribute View
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Compensating control
If you cannot upgrade immediately, limit access to any endpoints that expose renderAttributeView / attribute views so unauthenticated readers cannot call them to retrieve password-protected rows.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72806?
The severity of CVE-2026-72806 is medium, with a score of 5.8.
How do I fix CVE-2026-72806?
To fix CVE-2026-72806, upgrade to SiYuan version 3.7.4 or later.
What is the impact of CVE-2026-72806?
CVE-2026-72806 allows unauthenticated users to access password-protected document rows, potentially exposing sensitive information.
Which versions of SiYuan are affected by CVE-2026-72806?
SiYuan versions before 3.7.4 are affected by CVE-2026-72806.
Is CVE-2026-72806 an authentication vulnerability?
Yes, CVE-2026-72806 is an authentication bypass vulnerability that affects how publish password protection is enforced.