CVE-2026-72798 is a critical missing authorization vulnerability in SiYuan note-taking software before version 3.7.4. The flaw exists in the renderAttributeView function, which fails to properly filter content from related databases. As a result, anonymous users can access Relation and Rollup cell contents from databases that are supposed to be hidden or protected by passwords. Attackers can exploit this by requesting published databases that relate to restricted ones, thereby retrieving sensitive information or bypassing row filtering when the first column is a non-block type. The vulnerability has a CVSS 4.0 base score of 9.2, indicating high severity and network exploitable without privileges or user interaction.

Unauthorized anonymous users can access sensitive data from hidden or password-protected databases, including Relation and Rollup cell contents. This can lead to exposure of confidential information that should be restricted. The vulnerability allows bypassing of row filtering under specific conditions, increasing the risk of data leakage. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to published databases that relate to sensitive or restricted databases as a precaution.