---
id: "CVE-2026-72788"
kind: "vulnerability"
aliases: ["CVE-2026-72788", "GHSA-hgfg-j9pg-43xw", "GO-2026-6622"]
title: "SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel"
severity: "medium"
cvss: 6.9
epss: 0.00413
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["0.0.0-20260812083335-251596fc0de2"], "affected": "< 0.0.0-20260812083335-251596fc0de2", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "package", "publish-mode", "self-hosted", "siyuan"]
not_affected_if: ["auth-required", "managed-hosting", "not-publishing"]
published_at: "2026-08-12T20:17:50+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:46:03+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6622", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-72788", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72788", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# SiYuan discloses an administrator's open documents and search terms to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan, a note-taking app, exposes the administrator's open documents, search terms, notebook paths and private asset locations to anonymous users through its getConf endpoint. An attacker with no account can read this workspace state, but not the note contents themselves.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected < 0.0.0-20260812083335-251596fc0de2 fixed 0.0.0-20260812083335-251596fc0de2

## How to check

Run the SiYuan kernel and request getConf without a session, e.g. curl -X POST http://HOST:6806/api/system/getConf (unknown whether that is the exact route in every build).
Check the installed version is below v3.7.4 (the Go module version is 0.0.0-20260812083335-251596fc0de2 or newer for the fix).

## Fix

Upgrade SiYuan to v3.7.4 or later (Go module 0.0.0-20260812083335-251596fc0de2 or newer).
If publish mode is used, make sure the admin workspace is not exposed to readers until upgraded.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6622
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-72788
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-72788

## From the sources

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the UILayout filter that fails to properly restrict administrator workspace state from publish readers. Unauthenticated attackers can retrieve the administrator's open documents, search terms, notebook paths, and private asset locations by calling the getConf endpoint without authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_