CVE-2026-72789 describes a missing authorization vulnerability in SiYuan note-taking software prior to version 3.7.4. The software fails to properly validate publish access for encrypted notebooks, causing them to be exposed as publicly accessible by default. As a result, anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through the publish API without requiring authentication or possession of encryption keys. This represents a critical confidentiality breach.

The vulnerability allows unauthorized anonymous users to access sensitive decrypted content from encrypted notebooks that are unlocked, bypassing intended access controls. This leads to a complete loss of confidentiality for affected notebooks. There is no indication of privilege escalation, integrity, or availability impacts. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 3.7.4 or later once available or apply any official fixes provided by the vendor. Until then, avoid publishing encrypted notebooks or restrict access to trusted users only. Monitor vendor channels for updates.