CVE-2026-72788

Executive Summary

CVE-2026-72788 is an information disclosure vulnerability in SiYuan, the open-source note-taking and knowledge-management application, affecting versions before v3.7.4. The vulnerability resides in the UILayout filter, which fails to properly strip administrative workspace state from data served to publish readers, allowing unauthenticated remote attackers to call the getConf endpoint and retrieve the administrator's open documents, search terms, notebook paths, and private asset locations. Exploitation requires only network access to a SiYuan instance; no credentials or user interaction are needed. The vulnerability has no verified patch in tracked sources, but the NVD description implies a fix was introduced in v3.7.4.

Technical Analysis

SiYuan operates on a client-server model in which a local kernel provides a web-based API and workspace management. In publish mode, SiYuan exposes notes to anonymous readers without authentication. The NVD description identifies the flaw as an incorrect authorization condition (CWE-863): the UILayout filter — a component intended to sanitize UI state before it reaches publish readers — fails to restrict the administrator workspace state from those readers.

The vulnerable code path is triggered when an unauthenticated request reaches the getConf endpoint. In a correctly configured deployment, this endpoint should either require authentication or return a redacted view of the configuration that excludes administrator-only details. Due to the faulty UILayout filter, the response includes sensitive workspace metadata: the administrator's currently open documents, search terms used in the workspace, notebook path structure, and the file locations of private assets.

The following details are confirmed by the NVD description:

• Affected component: UILayout filter.
• Exposed API: getConf endpoint.
• Attacker prerequisites: none (unauthenticated, remotely accessible).
• Leaked data classes: open documents, search terms, notebook paths, private asset locations.

The NVD description does not specify the HTTP method or exact request format used to invoke the getConf endpoint. The vulnerability class is consistent with missing/incorrect authorization checks on a configuration API: the endpoint is reachable without a session, and the downstream filter that is supposed to apply per-role data masking never executes or executes with an insufficient rule set. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N), the vulnerable component is a network-facing service, the attack complexity is low, no privileges are required, and the scope change indicates that the compromised component (API layer) affects a different asset (the administrator's workspace state).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template was identified at the time of writing. The attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker locates an internet-exposed SiYuan instance. Candidate hosts can be discovered via Shodan-style queries for SiYuan web titles and common kernel ports, or by identifying a SiYuan publish page URL. Redirection to a login page is not required — publish-facing instances intentionally serve content to anonymous readers.

2. Flaw trigger: The attacker sends an HTTP request to the getConf endpoint without supplying any session cookie or authorization header. Because the application fails to enforce authentication on this endpoint, the request is processed server-side as a valid configuration read. The UILayout filter, which should substitute a sanitized layout for anonymous/publish users, does not restrict the administrator workspace state and allows the full configuration object to be generated.

3. Payload / execution at the vulnerability-class level: The request itself is likely a simple GET or JSON body containing the getConf method name — sufficient technical detail is not available in the public description to state the exact encoding. The response body contains serialized configuration data that includes the administrator's open document identifiers, recent search terms, notebook hierarchy/paths, and private asset file locations. No injection or memory-corruption technique is required; the flaw is purely a missing authorization check.

4. Post-exploitation impact: The leaked metadata gives the attacker a map of the victim's workspace: internal note titles, directory structure for notebooks, and the location of private attachments/assets. This information can be used to target subsequent API calls (e.g., retrieving specific notes or assets if other endpoints are also misconfigured), to perform social engineering using real internal document names, or to pivot toward additional data-exposure paths. Because the disclosure includes search terms, the attacker may also infer the administrator's areas of interest or sensitive projects.

Impact Assessment

The vulnerability has a CVSS v3.1 base score of 5.8 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. Key subscore observations:

• Attack vector (AV:N): remotely exploitable over the network.
• Attack complexity (AC:L): no special conditions, race, or evasion required.
• Privileges required (PR:N): no authentication required — the most severe aspect of this finding.
• User interaction (UI:N): no victim action needed.
• Scope change (S:C): the vulnerable API component is distinct from the affected administrator workspace; a compromise of the API layer leaks data from a separate security domain.
• Confidentiality (C:L): limited to metadata (document names, paths, search terms) rather than full note contents — though in practice, leaked notebook paths/asset locations can lead to further exposure.
• Integrity (I:N) / Availability (A:N): not affected.

For an individual self-hosting user, the practical impact is privacy loss: the names and paths of private notes, and the location of private assets, become visible to any anonymous internet user able to reach the instance. For an enterprise running SiYuan as a shared knowledge base, the blast radius includes disclosure of internal project names, organizational terminology, repository/folder naming conventions, and the administrator's working context. This information is valuable for intelligence gathering prior to targeted attacks. The EPSS score (0.00292, 21.8th percentile) indicates a low current probability of exploitation in the wild, and the CVE is not listed on the CISA KEV catalog; however, the unauthenticated nature and low complexity of the flaw mean it is an attractive target once public scanners incorporate it.

Detection Guidance

Sigma Rule

title: SiYuan Unauthenticated getConf Endpoint Access (CVE-2026-72788)
id: 5f9e4a3c-7b1d-4e8a-9c2f-3d6b8a1e4f77
status: experimental
description: >
  Detects HTTP requests targeting the SiYuan getConf endpoint without
  authentication, indicating a possible attempt to exploit CVE-2026-72788
  (information disclosure of administrator workspace state).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-72788
author: Valters IT SOC
date: 2026/05/15
logsource:
  category: webserver
  product: generic
detection:
  selection_uri:
    c-uri|contains: 'getConf'
  selection_body:
    cs-method: 'POST'
    cs-body|contains: 'getConf'
  filter_authed:
    c-auth|contains: 'token'
  condition: (selection_uri or selection_body) and not filter_authed
falsepositives:
  - Internal monitoring scripts that legitimately query the API without a token
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-72788
  - cwe.863

YARA Rule

rule CVE_2026_72788_SiYuan_getConf_Dataloss
{
    meta:
        author = "Valters IT SOC"
        description = "Detects network payloads or logs associated with CVE-2026-72788 - unauthenticated access to SiYuan getConf endpoint and leakage of administrator workspace state"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72788"
        cve = "CVE-2026-72788"
        date = "2026-05-15"
    strings:
        $s1 = "getConf" ascii nocase
        $s2 = "SiYuan" ascii nocase wide
        $s3 = "notebook" ascii nocase
        $s4 = "search" ascii nocase
        $s5 = "asset" ascii nocase
        $s6 = "document" ascii nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET CVE-2026-72788 SiYuan getConf Unauthenticated Information Disclosure Attempt (URI)"; flow:to_server,established; http.uri; content:"getConf"; nocase; metadata:created_at 2026_05_15; reference:cve,2026-72788; classtype:attempted-recon; sid:202672788; rev:1;)
alert http any any -> any any (msg:"ET CVE-2026-72788 SiYuan getConf Unauthenticated Information Disclosure Attempt (Body)"; flow:to_server,established; http.request_body; content:"getConf"; nocase; metadata:created_at 2026_05_15; reference:cve,2026-72788; classtype:attempted-recon; sid:202672789; rev:1;)

Notes: Tune these rules to the IP ranges of known SiYuan deployments to reduce false positives. A complementary rule can flag HTTP responses containing both "getConf" and "notebook" keywords in the response body to detect successful data exfiltration.

Elastic Detection

sequence with maxspan=5m
  [ any where event.category == "web" and
      (wildcard(url.full, "*getConf*") or
       wildcard(http.request.body.content, "*getConf*")) ]
  [ any where event.category == "web" and
      http.response.status_code == 200 and
      wildcard(http.response.body.content, "*notebook*") ]

This EQL query correlates an inbound request containing the getConf keyword with a subsequent 200 response containing workspace-related content ("notebook"), indicating a probable successful information disclosure. If response-body logging is not enabled, the second event can be dropped, leaving the request-side detection.

Splunk SPL Query

index=proxy OR index=web
  (match(url, "(?i)getConf") OR match(http_request_body, "(?i)getConf"))
| eval src_ip = coalesce(src_ip, clientip)
| table _time, src_ip, dest_ip, dest_port, url, http_method, http_response_code
| stats count by src_ip, dest_ip, dest_port, url, http_method
| where count > 1
| sort - count

For response-side detection, add a downstream query filtering for HTTP 200 responses whose body contains "notebook" and "getConf" if full-body logging is available:

index=web http_response_code=200
  match(http_response_body, "(?i)getConf") AND match(http_response_body, "(?i)notebook")
| table _time, src_ip, dest_ip, url, http_response_code

Wazuh OSSEC Rule

<group name="web,siyuan,cve_2026_72788,">
  <rule id="731096" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*getConf\.*</field>
    <description>CVE-2026-72788: SiYuan getConf endpoint accessed without authentication (possible information disclosure)</description>
    <group>attack_recon,attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
      <tactic>Initial Access</tactic>
    </mitre>
  </rule>
  <rule id="731097" level="14">
    <decoded_as>json</decoded_as>
    <field name="url">\.*getConf\.*</field>
    <field name="status">200</field>
    <description>CVE-2026-72788: SiYuan getConf endpoint returned 200 - possible successful disclosure of administrator workspace state</description>
    <group>attack_collection,</group>
    <mitre>
      <id>T1213</id>
      <tactic>Collection</tactic>
    </mitre>
  </rule>
</group>

These rules assume the intrusion-detection framework (e.g., Wazuh) ingests web-server or reverse-proxy access logs with fields parsed as JSON. Adjust field names and decoder settings to match the deployment.

Mitigation & Patch Guidance

Patch confidence is 0/4 — no vendor patch has been confirmed by any tracked source, and no official vendor fix or workaround documentation was provided in the public data. The NVD description states that versions before v3.7.4 are affected, implying that v3.7.4 is the first fixed release.

1. Immediate mitigations (no patch available):

• Restrict network access to the SiYuan kernel/API port using firewall rules. Do not expose the SiYuan HTTP API to the internet; allow only trusted IP ranges or VPN connections.
• Disable SiYuan publish/anonymous-reader mode if it is not strictly required, as the vulnerable code path is described as reachable by publish readers.
• If publish mode is required, place a reverse proxy in front of SiYuan that enforces authentication (e.g., HTTP Basic Auth, OIDC, or client certificates) for all requests, including the getConf endpoint. Note that this is a compensating control, not a fix for the underlying authorization flaw.
• Monitor logs for requests containing the getConf keyword, especially from unknown source IPs, using the detection rules above.

2. Patch / upgrade steps:

• Upgrade SiYuan to v3.7.4 or later as soon as the release is verified by the vendor, since all versions before v3.7.4 are affected per the NVD description.
• After upgrading, confirm the UILayout filter behavior by issuing an unauthenticated request to the getConf endpoint and verifying that administrative workspace data (open documents, search terms, notebook paths, private asset locations) is no longer returned.
• Re-test any existing integrations that depend on the getConf API, as hardening may change response schemas.

3. Long-term hardening:

• Maintain a formal asset inventory of all SiYuan instances and ensure they are patched through a change-management process.
• Apply the principle of least privilege to the SiYuan kernel process itself: run it as a dedicated non-privileged user, and restrict filesystem access to the workspace directory tree.
• Consider containerizing SiYuan and using network policies to prevent the API from being reachable beyond the local host or management network.
• Subscribe to SiYuan release notes and the project's security advisories to receive timely patch notifications.
• Periodically audit exposed web properties for unintentionally published services using external scanners.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72788
• MITRE CWE-863 (Incorrect Authorization): https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• SiYuan Project (GitHub): https://github.com/siyuan-note/siyuan
• CISA Known Exploited Vulnerabilities Catalog: not applicable (CVE-2026-72788 is not listed)

Threat-actor activity: No active campaigns, exploit-in-the-wild evidence, or public PoC exploits were identified for CVE-2026-72788 at the time of writing. The EPSS score of 0.00292 (21.8th percentile) and the absence of a CISA KEV listing indicate that exploitation is not currently widespread. Nevertheless, the unauthenticated, low-complexity nature of the flaw makes it a candidate for inclusion in automated scanning and exploitation tooling, and organizations exposing SiYuan instances to the internet should treat it as a priority for remediation once a verified patched release becomes available.