CVE-2026-72792

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the '/api/tag/getTag' endpoint. The system uses a filter called FilterTagsByPublishIgnore that only verifies if a document is visible, failing to check if the document is protected by a password. Consequently, unauthenticated readers can retrieve tag labels and their occurrence counts from password-protected documents. This allows attackers to enumerate internal terminology, project codenames, and personal or client names authored within the protected documents.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary workaround, restrict access to the '/api/tag/getTag' endpoint to minimize the risk of information disclosure.