Security readout for executives and security teams
Plain-English summary
SiYuan installations before 3.7.4 may expose protected document content through published blocks containing embed queries. An unauthenticated attacker could read password-protected, hidden, or forbidden information. The issue affects confidentiality, not integrity or availability, but exposed notes may contain credentials, internal plans, customer information, or other sensitive business data.
Executive priority
Treat this as an immediate confidentiality risk. Prioritize internet-facing or externally shared SiYuan deployments, upgrade them promptly, and investigate possible access to sensitive notes. Escalate incident review if logs show suspicious use of the affected endpoints. The supplied evidence does not confirm exploitation in the wild.
Technical view
The getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints do not enforce publish-access filtering on embedded block content. A request involving a published block with an embed query can therefore cross authorization boundaries and disclose protected documents. The issue is classified as CWE-862 and has a CVSS 4.0 score of 9.2.
Likely exposure
SiYuan deployments earlier than 3.7.4 are potentially exposed when relevant publishing endpoints are reachable and published blocks contain embed queries referencing protected content. Risk is greatest for publicly reachable instances. The supplied sources do not establish how commonly vulnerable configurations occur or whether exposure requires additional publishing settings.
Exploitation context
The vector is network-accessible, requires no privileges or user interaction, and has low attack complexity according to the supplied CVSS data. CVSS indicates high confidentiality impact across vulnerable and subsequent systems. The CVE is not listed as KEV, and the supplied sources provide no evidence of active exploitation.
Researcher notes
Authorization filtering is missing after embed resolution, allowing published content to expose blocks outside its permitted publication scope. Focus review on access-control enforcement in both named endpoints and equivalent embed-rendering paths. Available evidence establishes disclosure behavior and the fixed version boundary, but provides no exploit prevalence, affected-configuration frequency, or forensic indicators.
Mitigation direction
- Upgrade SiYuan to version 3.7.4 or later.
- Restrict public access to affected publishing endpoints until upgrading.
- Review published embed blocks for references to protected documents.
- Follow the vendor advisory for any additional deployment-specific guidance.
Validation and detection
- Inventory SiYuan versions and identify every installation earlier than 3.7.4.
- Confirm upgraded instances report version 3.7.4 or later.
- Review endpoint access logs for unexpected unauthenticated requests involving embedded blocks.
- Verify published content cannot reveal password-protected, hidden, or forbidden documents.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72795 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-h6w7-xxcf-w2mq)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via Embed BlockCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.