External risk intelligence

SiYuan WebSocket Broadcast Publish Boundary Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-72810

SiYuan is a note-taking application that features a web-based publishing and collaboration interface. The vulnerability exists within WebSocket broadcast sessions used for this publish surface, which is designed to be accessible to external users for viewing content, making the vulnerable endpoint typically reachable via the public internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects note-taking software that allows users to publish content online. It could enable anonymous access to unauthenticated edits, potentially exposing sensitive information from password-protected or restricted documents to unauthorized viewers through a real-time data stream.

Unfiltered edits sent to anonymous readers.
Important for note-taking app, publishing features.
Confirm if your published content is exposed.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by establishing an unauthenticated WebSocket connection to the publish surface. This bypasses intended access controls, allowing anonymous readers to receive unfiltered edits and sensitive content, including password-protected or forbidden documents.

Unauthenticated network access required.
WebSocket broadcast session is triggered.
Anonymous readers bypass access controls.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, anonymous readers could access unfiltered real-time content from WebSocket broadcast sessions, including sensitive documents like those protected by passwords or access controls, without authentication.

Unauthenticated access to sensitive documents.
Via WebSocket broadcast sessions.
Exposure of password-protected content.

Operational Fix

Recommended remediation, mitigation, and detection steps

The affected technology, SiYuan, is a note-taking application with a web-based publishing feature that is typically exposed externally. Teams responsible for application security, infrastructure, or platform management should prioritize identifying all instances of SiYuan that use the publish surface. The immediate first step is to confirm reachability and business criticality to accurately assess risk and plan remediation, coordinating with the vendor if necessary.

Application owners and security teams should own this issue.
Verify external reachability of the publish surface.
Plan vendor-assisted remediation or mitigating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan and how is it used?

SiYuan is a privacy-first, self-hosted personal knowledge management and note-taking application. It supports structured block-based editing and offers a web-based publishing feature, allowing users to share their notes or knowledge bases publicly or collaboratively over the internet.

What does CWE-862 mean for CVE-2026-72810?

CWE-862 is a weakness class defined as Missing Authorization. In the context of this vulnerability, it means the software fails to verify the identity or permissions of a user before granting access to sensitive data streams. Even though certain documents are intended to be restricted or password-protected, the application allows unauthorized viewers to tap into the data flow.

How is the WebSocket broadcast session triggered?

An attacker triggers this flaw by initiating an unauthenticated WebSocket connection directly to the application's publish surface. The vulnerability specifically affects the live broadcast mechanism; it does not require a user to log in or provide valid credentials to intercept the real-time data stream of content edits.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal identifies this as an external risk because the publish surface is designed to make content reachable to internet users. Since the WebSocket endpoint is part of this public-facing interface, it is accessible to anyone on the internet without needing internal network access, increasing the potential for unauthorized data exposure.

What should I do if I run SiYuan?

You should immediately check your instance to see if the publishing feature is enabled and accessible over the internet. Prioritize verifying your version number against the vendor's security guidance and prepare to apply the recommended update to close the authorization gap. If an immediate update is not possible, consider temporarily disabling the public publishing function.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.