CVE-2026-72799

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description In publish mode, when the Publish.Auth.Enable variable is set to false, the software fails to enforce publish-access filters on five filetree path-resolution endpoints: 'getFullHPathByID', 'getHPathByID', 'getPathByID', 'getIDsByHPath', and 'getHPathByPath'. This allows an unauthenticated reader or any user with a publish reader token to enumerate the complete private document tree. This includes mapping notebook names, folder hierarchies, and document titles, as well as resolving title paths to document IDs for documents that are password-protected, hidden, or marked as publish-forbidden.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, ensure that the Publish.Auth.Enable variable is set to true to enforce authentication for publish access.