External risk intelligence

SiYuan Database Content Disclosure via renderAttributeView.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-72798

SiYuan is a note-taking application that supports publishing databases and content to the web. Because the vulnerability involves the unauthorized access of published or public-facing database content, the affected surface is commonly deployed as an internet-accessible web endpoint.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in SiYuan that could allow unauthorized access to sensitive information. This issue affects the way related database content is handled when displayed, potentially exposing data from hidden or protected databases to anonymous readers. The primary concern is to confirm if this specific technology is in use and if any sensitive information could be exposed.

Sensitive data can be viewed by anonymous users.
Protects against unintended exposure of private notes.
Confirm usage and assess potential data exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing a publicly published database that is related to a hidden or password-protected database. This allows the attacker to view sensitive data that should not be accessible, including bypassing restrictions designed to keep certain content private.

Requires access to published databases.
Triggers when requesting related database content.
Exposes sensitive or hidden database information.

Live Threat

Current exploitation, exposure, and threat context

Anonymous readers could access sensitive content from hidden or password-protected databases when interacting with published SiYuan databases, potentially bypassing row filtering under specific conditions.

Relation and Rollup cell contents at risk.
Via published databases and related content.
Unauthorized access to sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts SiYuan note-taking applications, particularly those publishing content online. Application owners are responsible for identifying instances of SiYuan, determining their exposure and criticality, and coordinating remediation. The first practical move involves locating all deployed SiYuan instances, assessing their reachability and business impact, identifying the accountable owner, and then planning remediation based on the assessed risk.

Application owners should manage this issue.
Verify exposed or business-critical instances first.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan and how is it used?

SiYuan is a privacy-first, self-hosted note-taking application. It supports blocks, local-first storage, and the ability to publish databases and notes to the web. Users often deploy it to manage knowledge bases where they can selectively share information with others while keeping sensitive details private.

What is the nature of the CVE-2026-72798 vulnerability?

This flaw is a case of Missing Authorization, categorized as CWE-862. It occurs because the software fails to enforce proper permission checks when displaying related database content. Consequently, an anonymous reader can access sensitive Relation and Rollup cell information that was intended to remain hidden or password-protected.

How does an attacker trigger this vulnerability?

The issue is triggered when an attacker interacts with a publicly published SiYuan database. By requesting related content, they can cause the system to expose data from private databases linked to that public view. Simply browsing local, unpublished notes does not trigger this vulnerability.

Is my SiYuan instance at risk?

If you publish databases or notes to the internet, your instance is at higher risk. Halo Surface Signal identifies SiYuan as a web-facing application when features are enabled to share content publicly. If your instance is entirely internal and not accessible via the internet, the reachability of this vulnerability is significantly reduced.

How should I respond to this security notice?

First, locate all running instances of SiYuan within your environment to confirm which ones are internet-facing. Evaluate the sensitivity of the data contained within your databases. Prioritize reviewing the access permissions and visibility settings of any published databases, and plan to update your software to version 3.7.4 or later.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.