CVE-2026-72790 describes an information disclosure vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability exists because the /api/notebook/getNotebookInfo API endpoint does not enforce authorization checks, allowing unauthenticated attackers to retrieve metadata about notebooks that should be restricted. This includes notebook names, document counts, sizes, and timestamps for notebooks that are closed or unpublished. The CVSS 4.0 vector indicates the vulnerability is remotely exploitable without privileges or user interaction and results in low-impact confidentiality loss.

Attackers can obtain sensitive metadata about notebooks that are intended to be hidden, potentially exposing information about the existence and characteristics of private or unpublished notebooks. This does not appear to allow access to the notebook content itself, only metadata. The impact is limited to information disclosure of metadata, rated as medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from the SiYuan project and apply any official patches when available. Until then, restricting access to the affected API endpoint through network controls or authentication proxies may reduce exposure.