CVE-2026-72797

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An information disclosure issue exists in the 'getEncryptedNotebookStatus' endpoint. The system fails to apply publish-access filtering, allowing anonymous readers and accounts in publish-mode to enumerate all encrypted notebooks. This exposure reveals sensitive data, including notebook identifiers, names, and their current lock or decryption states in memory.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the 'getEncryptedNotebookStatus' endpoint.