Live › vulnerability › CVE-2026-72788
Go to dashboardSiYuan, a note-taking app, exposes the administrator's open documents, search terms, notebook paths and private asset locations to anonymous users through its getConf endpoint. An attacker with no account can read this workspace state, but not the note contents themselves.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260812083335-251596fc0de2 | 0.0.0-20260812083335-251596fc0de2 |
curl -X POST http://HOST:6806/api/system/getConf (unknown whether that is the exact route in every build)v3.7.4 (the Go module version is 0.0.0-20260812083335-251596fc0de2 or newer for the fix)v3.7.4 or later (Go module 0.0.0-20260812083335-251596fc0de2 or newer)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.
This page as .md · .json · in your agent: get_signal("CVE-2026-72788")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.