What’s Vulnerable › Vulnerabilities

CVE-2026-72806: SiYuan before v3.7.4 Authentication Bypass via Attribute View

• Severity: medium (CVSS 5.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-12 · updated 2026-10-24
• Weakness: CWE-862

Description

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.

Affected products

• siyuan-note siyuan: before 3.7.4 — fixed in 3.7.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.4. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv
• https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv

Get alerted when CVE-2026-72806 or the next vulnerability affects your stack