CVE-2026-72788

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the UILayout filter that fails to properly restrict the administrator's workspace state from publish readers. Unauthenticated attackers can retrieve sensitive information about the administrator's active session by calling the getConf endpoint via a POST request to /api/system/getConf.

The issue stems from four defects in the filterLayoutItemByPublishIgnore function: it fails to check the password protection tier, fails open when a document is unresolvable (such as in locked or closed notebooks), ignores non-editor tabs (including Asset, Outline, Search, and Custom types), and does not filter docks. Consequently, an attacker can obtain titles and identifiers of password-protected documents, titles of documents in locked or closed notebooks, search terms and their scoped paths, and filesystem paths of private assets.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the /api/system/getConf endpoint to prevent unauthenticated users from retrieving configuration data.