CVE-2026-72801 affects SiYuan note-taking software versions prior to v3.7.4. The vulnerability arises because encrypted-notebook key-derivation material and wrapped data keys are disclosed through unauthenticated endpoints when the software is in publish mode. Attackers can retrieve sensitive cryptographic parameters including Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys. This exposure allows attackers to conduct unlimited offline cracking of the master password without any rate limiting or authentication barriers. The CVSS 4.0 score is 8.7, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

An attacker can obtain key derivation parameters and wrapped keys without authentication, enabling unlimited offline brute-force attacks on the master password. This compromises the confidentiality of encrypted notebooks. There is no indication of privilege escalation or integrity/availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before v3.7.4, upgrading to v3.7.4 or later is likely recommended once confirmed by the vendor. Until then, avoid using publish mode or exposing unauthenticated endpoints that reveal key derivation material.