CVE-2026-72798 is a missing authorization flaw in SiYuan publish mode. The renderAttributeView function did not filter content from related databases, so anonymous readers could see data from hidden or password protected ones. The record scores it 8.6, High. Upgrade to SiYuan v3.7.4 or later.
What's affected
The record says SiYuan versions before v3.7.4 are affected. The GitHub advisory lists affected versions as v3.7.2 and earlier, with v3.7.4 as the patched release. Both point to the same fix, so move to v3.7.4 or later.
The advisory describes two defects. First, the access filter decides whether a row is allowed from its first cell only, and never checks the values of the other cells. Relation and Rollup cells carry mirrored content from a different database, so a published database can hand a reader data from a related one whose host document is hidden, publish-forbidden or password protected. Second, when the first column is not a block value, the check is skipped and the row is returned unchecked.
The weakness class is CWE-862, missing authorization.
How to check if you're exposed
Check the version of every SiYuan instance you run, especially ones that publish content to readers.
docker ps --format '{{.Names}} {{.Image}}'
The command above lists container names and image tags, so you can see whether a running SiYuan container is pinned to a version below v3.7.4. For desktop or binary installs, open the About panel in the app. The advisory describes the issue as affecting publish mode, so a private instance that never publishes is not the main concern. Look for any instance that serves pages to readers, with or without a publish password.
Then look at your data model. Do you publish a database that has Relation or Rollup columns pointing at a database you meant to keep private or protected by password? Those are the pairs the advisory describes. A published database with no relations to a restricted one is a smaller concern.
What to do now
- Upgrade SiYuan to v3.7.4 or later on every instance that publishes content.
- List your published databases that use Relation or Rollup columns and note which related databases are meant to stay private.
- Until you upgrade, unpublish databases that relate to restricted ones.
- Assume that content in related restricted databases may have been read by anonymous readers on vulnerable versions, and decide whether any of it needs a notification or a change.
- Check the access logs of your reverse proxy for requests to published database views from unfamiliar sources.
- Recheck the published view after the upgrade to confirm related content is no longer shown.
Why it matters
Access control that looks only at the first field of a record is fragile. A database view is built from several cells, and some of those cells pull in data from other places. A check on the row's own block says nothing about the content that was mirrored into it from somewhere else. The same advisory notes that fixing the row drop condition alone would close neither defect, which shows how easy it is to patch one path and leave the other.
On severity, the record scores it 8.6 High under CVSS 3.1. The GitHub advisory labels it High, and VulnCheck says high at 9.2 under CVSS 4.0. The sources agree on direction. The impact is confidentiality only, but anonymous readers need no account. No source reports exploitation in the wild, and the CVE is not on the CISA KEV list.
Quick check
What exactly could an anonymous reader see?
Relation and Rollup cell contents that come from hidden or password protected databases, and in some cases whole rows when the first column is not a block type.
Which version fixes it?
The advisory lists v3.7.4 as patched, and the record says versions before v3.7.4 are affected.
Sources
Last reviewed: 18 October 2026.
