CVE-2026-72800 describes an authorization bypass vulnerability in SiYuan note-taking software versions prior to v3.7.4. The getAttributeViewKeysByID endpoint lacks publish-access filtering, allowing authenticated readers to retrieve full database column schemas, including descriptions, select vocabularies, and template expressions. Additionally, the getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate workspace-wide block IDs without enforcing publish scoping, enabling discovery of valid block identifiers beyond intended publish boundaries. This results in unauthorized information disclosure of content from hidden or password-protected documents.

The vulnerability enables authenticated users with reader access to bypass publish-access restrictions and retrieve sensitive metadata and content identifiers from the database. This could lead to exposure of confidential or restricted information contained in hidden or password-protected documents. There is no indication of privilege escalation, remote code execution, or denial of service impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v3.7.4, upgrading to v3.7.4 or later is recommended once official fixes are available. Until then, restrict authenticated user access to trusted parties and monitor for unusual access patterns related to the affected endpoints.