CVE-2026-72797 is an information disclosure vulnerability affecting SiYuan note-taking software versions prior to v3.7.4. The vulnerability exists in the getEncryptedNotebookStatus endpoint, which fails to enforce publish-access filtering. This allows unauthenticated or publish-mode users to retrieve encrypted notebook identifiers, names, and lock states, thereby enumerating all encrypted notebooks and revealing their current unlock status. The exposure of sensitive notebook metadata and decryption state information could lead to privacy concerns. The CVSS 4.0 base score is 6.9, indicating a medium severity vulnerability. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

The vulnerability allows unauthorized users, including anonymous readers and publish-mode accounts, to enumerate encrypted notebooks and view their names and unlock states. This leads to information disclosure of sensitive notebook metadata and decryption status, potentially compromising user privacy. There is no indication of direct code execution or data modification impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the getEncryptedNotebookStatus endpoint to trusted users only, if possible, and monitor for unusual access patterns related to notebook enumeration.