Security readout for executives and security teams
Plain-English summary
SiYuan before version 3.7.4 can expose sensitive database information to anonymous readers. Content in hidden or password-protected databases may become visible through published databases that reference it. This is a confidentiality issue; the supplied sources do not report data modification or service disruption.
Executive priority
Prioritize remediation immediately for internet-accessible SiYuan deployments using versions before 3.7.4, especially where published databases reference sensitive records. The impact is potentially serious confidentiality loss without authentication. If exposure is confirmed, initiate appropriate incident assessment and credential or data-response procedures based on the information involved.
Technical view
The renderAttributeView function insufficiently filters related-database content. Relation and Rollup cells can disclose restricted records through a published database. Row filtering can also be bypassed when the first column is a non-block type. Network access, low complexity, no privileges, and no user interaction are reflected in the supplied CVSS 4.0 score of 9.2.
Likely exposure
Exposure is most likely where a pre-3.7.4 SiYuan deployment publishes databases that reference hidden or password-protected databases. Deployments using affected versions but without published related databases may have lower practical exposure. The supplied evidence does not establish whether any specific organization is vulnerable.
Exploitation context
No active exploitation is established in the supplied bundle, and the CVE is not identified as being in KEV. However, anonymous network access and low attack complexity make exposed deployments attractive targets. Treat public publishing endpoints on affected versions as potentially accessible until validated.
Researcher notes
The vulnerability is categorized as CWE-862 and affects confidentiality across both the vulnerable system and subsequent systems according to the supplied CVSS vector. Evidence identifies two disclosure paths: insufficient filtering of related Relation or Rollup cells, and row-filter bypass involving a non-block first column. Public exploit availability and real-world exploitation are not established.
Mitigation direction
- Upgrade SiYuan to version 3.7.4 or later following vendor guidance.
- Temporarily restrict public access to affected publishing features if upgrading cannot occur promptly.
- Review published databases for relationships to hidden or password-protected databases.
- Assess potentially exposed Relation and Rollup content for sensitive information.
- Review vendor guidance for any additional configuration or remediation requirements.
Validation and detection
- Inventory SiYuan deployments and confirm their exact installed versions.
- Identify publicly accessible databases and map their Relation and Rollup dependencies.
- Check whether referenced databases are hidden, password-protected, or subject to row filtering.
- After upgrading, verify anonymous users cannot view restricted related-database content.
- Review relevant access records for unexpected anonymous requests to published databases.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72798 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-mfrj-v65r-979c)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: SiYuan before v3.7.4 Information Disclosure via renderAttributeViewCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.