{"id":"CVE-2026-72789","revision":null,"records":[{"revision":"4c6039c6fcd441478de446d44aaf8957","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72789","aliases":[],"title":"SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks","description":"SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.","state":0,"publishedAt":"2026-08-12T19:07:38.239+00:00","modifiedAt":"2026-08-14T22:00:32.455+00:00","affected":[{"ecosystem":"Vendor product","name":"siyuan","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"siyuan-note\",\n                    \"product\": \"siyuan\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/siyuan-note/siyuan/kernel\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.4\"\n                        },\n                        {\n                            \"version\": \"3.7.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq","https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72789","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72789","identifiers":["CVE-2026-72789"]},"retained":false,"historicalAffected":[]},{"revision":"18a4b37b55144eb2a7eeb5504b517436","observedAt":"2026-10-25T15:19:03.401+00:00","statement":{"source":"nvd","id":"CVE-2026-72789","aliases":[],"title":"SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted n…","description":"SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without authentication or key material.","state":0,"publishedAt":"2026-08-12T20:17:50.27+00:00","modifiedAt":"2026-10-24T15:10:00.19+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq","https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72789","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-08-12T20:17:50.270","lastModified":"2026-10-24T15:10:00.190"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-72789","identifiers":["CVE-2026-72789"]},"retained":false,"historicalAffected":[]},{"revision":"913c6e553cd5441995c2b9c7f54a982f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-v684-q882-jgmq","aliases":["CVE-2026-72789","GO-2026-6434"],"title":"SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked","description":"**CVE:** This vulnerability corresponds to [CVE-2026-72789](https://nvd.nist.gov/vuln/detail/CVE-2026-72789).\n\n### Summary\n\n`publishAccess.json` is an opt-out list. The publish gate returns *accessible* for anything not explicitly listed in it. Encrypted notebooks are never written into that file, because only the administrator-gated `setPublishAccess` writes it and no part of the encryption subsystem does. Consequently every encrypted notebook is publish-accessible as far as the gate is concerned.\n\nWhile an encrypted notebook is unlocked, an anonymous reader in publish mode can list it, enumerate its documents, and retrieve their fully decrypted content. No key material, no password, and no cracking is involved. The kernel decrypts the data and serves it because the authorization layer never asks whether the notebook is encrypted.\n\nThis is reported as a defect in the gate rather than in any individual handler. Endpoints that were previously reviewed and found to apply the correct checks do apply them. The checks return true.\n\n### Details\n\n**The gate defaults to accessible.** `CheckPathAccessableByPublishIgnore(box, path, ignore)` iterates the ignore list and returns false only on a match:\n\n```go\nfor _, item := range publishIgnore {\n    if item.ID == box || strings.Contains(path, item.ID) {\n        return false\n    }\n}\nreturn true   // unlisted means accessible\n```\n\n**Encrypted notebooks are never listed.** `publishAccess.json` is written only by `setPublishAccess` (`kernel/api/router.go:169`), which carries `CheckAdminRole` and `CheckReadonly`. Nothing in `crypto.go`, `encrypted_ops.go` or `notebook_crypto.go` writes to it. An administrator would have to manually add each encrypted notebook to the ignore list to protect it, and nothing in the product prompts or documents that.\n\n**Neither core gate rejects them.** On both `eef105683` and `v3.7.4-alpha.1`:\n\n```go\nfunc checkBlockTreeAccessableByPublishAccess(...) bool {\n    return CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) &&\n           (password == \"\" || CheckPublishAuthCookie(c, passwordID, password))\n}\n```\n\nFor an encrypted notebook the first term is true because it is unlisted, and the second is true because encrypted notebooks carry no publish password. The conjunction returns true.\n\n`IsEncryptedBox` does not appear in `kernel/model/publish_access.go` at all on master. On the development branch it appears once, inside `parseAttributeViewForPublishAccess`, where it routes *into* encrypted boxes rather than excluding them. The publish authorization layer has no concept of an encrypted notebook.\n\n**The chain.** Verified on the development branch, which is the harder target because the block-metadata, attribute-view, path-resolution and encrypted-notebook-status fixes have all landed there.\n\n1. `lsNotebooks` calls `ListNotebooks()`, which includes encrypted notebooks and reports `Encrypted: boxConf.Encrypted` without filtering on it. The reader filter skips only notebooks that are `Closed` or publish-invisible. An unlocked encrypted notebook is neither, so it is returned to an anonymous reader together with its identifier.\n2. `listDocsByPath{notebook: <encrypted box id>, path: \"/\"}` applies only `CheckPathAccessableByPublishIgnore`, which passes, returning the document identifiers and titles inside the encrypted notebook.\n3. `getDoc` routes to `GetDocInBox(...)`, after which `FilterContentByPublishAccess(...)` returns the content unmodified because the box is unlisted. The response is the fully decrypted document. `getBlockKramdown` reaches `GetBlockKramdownInBox` for the same result in Markdown.\n\nHandlers reach the decrypted store through `encryptedNotebookFromArg(arg)` on a client-supplied notebook argument. This function predates the current release and is not a recent addition.\n\n**The precondition is the unlock window.** `GetBlockTreeInBox` returns nil while a notebook is locked, treating it as nonexistent, and non-nil once unlocked. So the exposure is bounded to the period during which the legitimate user has the notebook open, which is precisely the period in which they are working in it. No action by the attacker triggers or extends that window, but no unusual condition is required either.\n\n**On endpoints previously assessed as correctly gated.** `getBlockDOM` and `getBlockKramdown` apply password and visibility checks. `exportPreview` applies `FilterContentByPublishAccess`. Those assessments are accurate and this report does not contradict them. The checks execute and return true, because the visibility term resolves to accessible for an unlisted box and the password term is vacuous for a notebook that has no publish password. Patching any individual handler would not change that result.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. An encrypted notebook that is currently unlocked by the legitimate user.\n\nStep 1, obtain the encrypted notebook's identifier:\n\n```\nPOST http://127.0.0.1:6808/api/notebook/lsNotebooks\n{}\n\n→ 200. The list includes the encrypted notebook, with encrypted: true and its id.\n```\n\nStep 2, enumerate its documents:\n\n```\nPOST http://127.0.0.1:6808/api/filetree/listDocsByPath\n{\"notebook\":\"<encrypted box id>\",\"path\":\"/\"}\n\n→ 200, document identifiers and titles from inside the encrypted notebook\n```\n\nStep 3, retrieve decrypted content:\n\n```\nPOST http://127.0.0.1:6808/api/filetree/getDoc\n{\"id\":\"<document id from step 2>\"}\n\n→ 200, the fully decrypted document\n```\n\n`getBlockKramdown` returns the same content as decrypted Markdown. Repeating step 3 while the notebook is locked returns not-found, which confirms the unlock window is the only thing standing between an anonymous reader and the plaintext.\n\n### Impact\n\nThe confidentiality guarantee of the encrypted-notebook feature is defeated against a remote, unauthenticated attacker for as long as the notebook is unlocked. A user who encrypts a notebook is expressing that its contents should be protected beyond the ordinary publish boundary. The publish gate does not recognise that intent, and instead treats the notebook as publicly readable because nobody added it to an opt-out list that the encryption feature does not write to.\n\nThe exposure is full document content rather than metadata, and it applies to every document in the notebook. It requires no key material, no password, no offline work and no interaction with the encryption subsystem at all.\n\n### Suggested fix\n\nFail closed on encryption, independently of `publishAccess.json`:\n\n```go\nif IsEncryptedBox(bt.BoxID) {\n    return false\n}\n```\n\nin both `checkBlockTreeAccessableByPublishAccess` and `CheckBlockTreeMetadataAccessableByPublishAccess`, and exclude encrypted notebooks from `lsNotebooks` and `listDocsByPath` for read-only roles.\n\nThe broader point is the default. An opt-out authorization list means every future notebook type, storage backend or content class is publicly accessible until somebody remembers to add it. Encrypted notebooks are the case where that default is most clearly wrong, but they are unlikely to be the only one.","state":0,"publishedAt":"2026-09-08T17:56:07+00:00","modifiedAt":"2026-09-10T15:26:01.3774739+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260726020813-a25c2dd06aae"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq","https://nvd.nist.gov/vuln/detail/CVE-2026-72789","https://github.com/siyuan-note/siyuan/commit/a25c2dd06aae13d1de70cc61cbf98169689c9d86","https://github.com/siyuan-note/siyuan","https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks"],"sourceUrl":"https://github.com/advisories/GHSA-v684-q882-jgmq","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-v684-q882-jgmq","identifiers":["GHSA-v684-q882-jgmq","CVE-2026-72789","GO-2026-6434"]},"retained":false,"historicalAffected":[]},{"revision":"5c09a087c5b84c6cad10e4521a0d3a64","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6434","aliases":["CVE-2026-72789","GHSA-v684-q882-jgmq"],"title":"SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: The publish-access gate treats encrypted notebooks as publicly accessible by default, allowing anonymous readers to retrieve fully decrypted document content while a notebook is unlocked in github.com/siyuan-note/siyuan/kernel","state":0,"publishedAt":"2026-09-10T14:48:42+00:00","modifiedAt":"2026-09-10T15:15:15.0603094+00:00","affected":[{"ecosystem":"Go","name":"github.com/siyuan-note/siyuan/kernel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260726020813-a25c2dd06aae"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v684-q882-jgmq","https://nvd.nist.gov/vuln/detail/CVE-2026-72789","https://github.com/siyuan-note/siyuan/commit/a25c2dd06aae13d1de70cc61cbf98169689c9d86","https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-encrypted-notebooks"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6434","license":"OSV · upstream source license applies","key":"osv:GO-2026-6434","identifiers":["GO-2026-6434","CVE-2026-72789","GHSA-v684-q882-jgmq"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-25T22:04:08.5875992+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-25T22:04:08.5875992+00:00","lastSuccessAt":"2026-10-25T22:04:08.8596165+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.8596241+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-1a687ad2a0b90150aa7d97c9f39e63de695ae2db23e31ebc28df1492c461b23c-1c072e7db56f0d3179c99f5b33ed9988c328ad75783993f151d8522bc700aaba","complete":true,"records":414046,"lastAttemptAt":"2026-10-25T22:02:18.7733512+00:00","lastSuccessAt":"2026-10-25T22:02:18.6654575+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:02:18.7733512+00:00","snapshotPublishedAt":"2026-10-25T21:21:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-25T22:04:11.413428+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-25T22:04:08.5875992+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-25T22:04:08.5875992+00:00","lastSuccessAt":"2026-10-25T22:04:08.8610999+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.8611051+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-25T22:04:09.4303098+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-25T22:04:08.4463409+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.4463409+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-25T22:02:18.9302775+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:02:18.9302775+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-25T22:04:08.554556+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.554556+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11236ada05a0588e51df37636716526867f73fb127392c49680b6f8561496a99","complete":true,"records":230781,"lastAttemptAt":"2026-10-25T22:04:08.3201814+00:00","lastSuccessAt":"2026-10-25T22:04:07.173333+00:00","error":null,"lastVerifiedAt":"2026-10-25T22:04:08.3201814+00:00","snapshotPublishedAt":"2026-10-25T21:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}