CVE-2026-72801

HIGH

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline master-password cracking without rate limiting.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Published: 8/12/2026Modified: 8/14/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-72801 — SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation materia...

SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Attackers can retrieve Argon2id salt, cost parameters, password verifiers, and wrapped notebook keys to perform unlimited offline master-password cracking without rate limiting.

CVE-2026-72801
NIST NVD

References (3)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-8x84-r2ff-h8pqhttps://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-encryption-key-materialhttps://github.com/siyuan-note/siyuan/security/advisories/GHSA-8x84-r2ff-h8pq