CVE-2026-72798 | BDVDB-2026-358484 Detail

Description#

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-12Record published in the CVE List.
2. Version 22026-08-14Most recent update recorded in the CVE List.