CVE-2026-72796 describes an access control bypass in SiYuan note-taking software prior to version 3.7.4. The vulnerability arises because static-file routes in the server mux bypass the publish-access controls that are enforced on the REST API endpoints. As a result, attackers possessing publish reader tokens or operating in disabled-auth mode with anonymous access can directly access static routes to read sensitive content such as templates, snippets, and export artifacts. This bypass compromises confidentiality by exposing data that should be restricted by access controls.

The vulnerability allows unauthorized users to read protected content that should be restricted by publish-access controls. This can lead to exposure of templates, snippets, and export artifacts, potentially leaking sensitive or proprietary information. There is no indication of privilege escalation or modification capabilities, so the impact is limited to unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. Until a fix is available, restricting anonymous access and limiting publish reader tokens may reduce exposure risk.