PT-2026-71243
CVE-2026-72801
·
Published
2026-08-12
·
Updated
2026-09-21
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
SiYuan versions prior to 3.7.4
Description
In publish mode, unauthenticated endpoints disclose encrypted-notebook key-derivation material and wrapped data keys. This allows attackers to retrieve the Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys. Consequently, this enables unlimited offline master-password cracking without rate limiting. Argon2id is a password hashing function designed to resist GPU-based cracking attacks.
Recommendations
Update to version 3.7.4 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾