CVE-2026-72795

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An issue exists where the software fails to filter embedded block content based on publish access permissions. While the initial requested block is checked for authorization, blocks pulled in via embed queries (transclusion) are inlined into the returned DOM without any access checks. This allows an anonymous reader or a user with a publish reader token to read content from documents that are hidden, forbidden, or password-protected, provided they request a legitimately published block that contains an embed query matching those private documents.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary workaround, avoid publishing documents that contain embed queries spanning sensitive or password-protected areas of the workspace.