CVE-2026-72795 describes a missing authorization check in SiYuan note-taking software prior to version 3.7.4. Specifically, the endpoints getBlockDOMWithEmbed and getBlockDOMsWithEmbed do not enforce publish access restrictions on embedded block content. As a result, an attacker can request published blocks containing embed queries and gain unauthorized read access to sensitive content, including password-protected or hidden documents. This vulnerability has a CVSS 4.0 base score of 9.2, indicating critical severity with network attack vector, no privileges required, and high impact on confidentiality.

The vulnerability allows unauthenticated attackers to bypass access controls and read sensitive content from protected or hidden documents. This leads to a critical confidentiality breach, exposing potentially sensitive or private information without any authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.7.4, upgrading to version 3.7.4 or later is likely recommended once official fixes are published. Until then, restrict access to the affected endpoints or monitor for suspicious requests if possible.