CVE-2026-72788 describes an incorrect authorization vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability resides in the UILayout filter, which fails to properly restrict access to administrator workspace state data. As a result, unauthenticated attackers can retrieve sensitive information such as the administrator's open documents, search terms, notebook paths, and private asset locations by invoking the getConf endpoint without any authentication. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

An attacker without any authentication can obtain sensitive administrator workspace information including open documents, search terms, notebook paths, and private asset locations. This information disclosure could lead to further targeted attacks or privacy violations. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor vendor communications for updates. Until a fix is available, restricting network access to the getConf endpoint or implementing additional access controls may help mitigate exposure.