CVE-2026-72806

Executive Summary

CVE-2026-72806 is an authentication bypass vulnerability in SiYuan, an application that supports publishing documents, attribute views, and database rows with password protection. All versions before v3.7.4 are affected. The flaw resides in the FilterViewByPublishAccess filter, which fails to enforce publish password protection when attribute views and database rows are rendered; as a result, unauthenticated remote attackers can read password-protected document titles, block IDs, and column values by invoking renderAttributeView without supplying the required password. No patch has been confirmed by tracked sources, and no public exploit code or in-the-wild exploitation evidence exists as of this report.

Technical Analysis

The NVD description identifies CVE-2026-72806 as a missing-authorization flaw (CWE-862) in the SiYuan publishing subsystem. SiYuan's publish feature includes a password-protection mechanism intended to restrict read access to published content. When a publisher password-protects documents or views, the application is expected to filter out protected rows unless the requesting viewer presents the correct password.

The vulnerable component is the FilterViewByPublishAccess filter. According to the NVD description, this filter fails to check the publish password protection when rendering attribute views and database rows. The affected code path is reachable via the renderAttributeView operation. An unauthenticated caller can invoke this rendering operation without supplying the password, and the server responds with rows that belong to password-protected documents. The disclosure includes:

• Document titles
• Block IDs
• Column values

From a weakness-class perspective, the application performs a functional operation (rendering an attribute view) without first verifying that the requesting subject is authorized (i.e., has provided the required publish password). The authorization boundary intended by the FilterViewByPublishAccess filter is bypassed because the password check is not enforced along the renderAttributeView path. This is a classic instance of CWE-862: the resource is protected by an authorization mechanism that exists but is not invoked for a specific operation.

Technical details that are not contained in the NVD description — the exact HTTP request structure, the transport method (GET/POST), whether the password is expected as a query parameter, cookie, or body field, and the precise API route containing renderAttributeView — are unavailable. The attack is presumed to be an HTTP API request that omits the password value or supplies an empty one. The vulnerability is server-side; it requires no authentication, no user interaction, and no client-side manipulation.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) confirms the exposure profile: network-reachable, low attack complexity, no privileges required, no user interaction, scope change (the filter's authorization decision affects resources beyond its intended boundary), low confidentiality impact, and no integrity or availability impact.

EPSS scores this CVE at 0.00307 (23.4th percentile), indicating a low model-derived probability of near-term exploitation in the wild. CISA KEV does not include the CVE, and no threat-actor campaigns have been observed. However, patch confidence is 0/4 — no vendor commit, advisory, or package release has been confirmed by tracked sources — so the exposure window for affected instances remains open.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-72806. The following attack chain is therefore inferred from the vulnerability class (missing authorization) and the specific details in the NVD description ("calling renderAttributeView without supplying the required password"). Defenders should treat it as a hypothesis-driven baseline.

1. Reconnaissance / target identification: The attacker identifies publicly reachable SiYuan instances, particularly those configured to publish attribute views or database views. Internet-wide scanning for SiYuan application fingerprints (HTTP title or HTML markers) reveals candidate targets. The attacker then enumerates published pages that reference attribute views or database views, since those are the resource types named in the CVE.

2. Triggering the specific flaw: The attacker directly invokes the renderAttributeView operation against a published view containing password-protected rows. Instead of authenticating or supplying the publish password, the request is sent without the password value. Because FilterViewByPublishAccess does not enforce the password check during this rendering path, the server processes the request as authorized.

3. Payload / execution method: At the vulnerability-class level, the "payload" is an unauthenticated API call that omits a required credential. No injection primitive, memory corruption, or obfuscation is required. The request needs only to reference the affected rendering operation and the target view identifier. The response body then contains the protected rows.

4. Post-exploitation impact: The attacker harvests document titles, block IDs, and column values from rows that should be hidden behind the publish password. Repeating the call across multiple views allows broad extraction of protected metadata. Block IDs are internal identifiers that could aid in further content enumeration within the SiYuan publish surface. The CVSS scope-change (S:C) rating reflects that the vulnerable component's authorization decision exposes a resource beyond its intended security boundary.

Important caveat: because no PoC exists, these steps are inferred from the vulnerability class and the named components. Organizations that observe unauthenticated requests to renderAttributeView with 200 responses containing view data should treat that as a suspected exploitation attempt regardless of whether a formal exploit has been published.

Impact Assessment

• Business impact: For organizations using SiYuan as a document publishing or knowledge platform, this flaw exposes content that administrators explicitly marked as password-protected. Confidentiality is the sole impacted security objective (C:L). If the platform hosts sensitive internal notes, project data, or personal information, disclosure may constitute a reportable data breach.
• Affected systems: All SiYuan deployments running versions before v3.7.4 that have enabled publishing and use attribute views or database views with password protection. Because the vulnerability requires no authentication, any reachable instance — internet-exposed or internal — is in scope.
• Blast radius: The CVSS confidentiality magnitude is low (only titles, block IDs, and column values are explicitly named; full document body content is not listed as disclosed). However, the scope-change component (S:C) indicates the impact crosses a security boundary, and titles/column values in a notes or database context can be highly sensitive. There is no availability or integrity impact, limiting operational damage, but the lack of a confirmed patch means the exposure is persistent.
• Exploitation likelihood: EPSS 0.00307 (23.4th percentile) and absence from CISA KEV indicate that exploitation in the wild is currently uncommon. The low EPSS reflects a lack of observed activity, not technical difficulty; any attacker who discovers the flaw can exploit it reliably against an exposed instance.

Detection Guidance

The detection strategy centers on identifying unauthenticated HTTP requests to SiYuan that reference the renderAttributeView operation, as well as anomalous response patterns indicating the disclosure of protected view data. Field names in the rules below assume standard web-server access logs and must be adapted to your local log schema.

Sigma Rule

title: SiYuan renderAttributeView Unauthenticated Access Attempt
id: 3f8c1ab2-9d4e-4c2b-8a7f-1e5b0c6d9a21
status: experimental
description: Detects HTTP requests to the SiYuan renderAttributeView operation without an authenticated session, indicating a possible CVE-2026-72806 authentication bypass attempt.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-72806
tags:
    - attack.t1190
    - cve.2026-72806
logsource:
    category: webserver
detection:
    selection:
        http.url|contains: renderAttributeView
    filter_auth:
        http.cookie|contains: session
    condition: selection and not filter_auth
falsepositives:
    - Legitimate rendering requests where the password is supplied via a header or body field not represented in this log source
level: high

YARA Rule

rule SiYuan_CVE_2026_72806_RenderAttributeView
{
    meta:
        author = "Valters IT Security"
        description = "Detects HTTP request artifacts referencing SiYuan renderAttributeView, associated with CVE-2026-72806 authentication bypass"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-72806"
        cve = "2026-72806"
        date = "2026-01-01"
    strings:
        $s1 = "renderAttributeView" ascii wide nocase
    condition:
        $s1
}

Note: this YARA rule is intentionally minimal because the NVD description provides only the renderAttributeView method name. For higher fidelity, pair the rule with a second condition such as the absence of authentication markers ("session", "token", "authorization") in the scanned content — but do not assume specific parameter names, as they are not disclosed.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-72806 SiYuan renderAttributeView unauthenticated access attempt"; flow:to_server,established; http.uri; content:"renderAttributeView"; nocase; classtype:attempted-recon; reference:cve,2026-72806; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72806; sid:202672806; rev:1;)

Note: the rule triggers on any request whose URI contains renderAttributeView. The NVD description does not specify the HTTP method; if your environment observes the legitimate operation via a different method, tune accordingly (e.g., add http.method; content:"POST"; nocase; if POST is confirmed in your traffic). Place $HOME_NET as the SiYuan server's address in production.

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.uri contains "renderAttributeView" ]
  [ network where http.response.status_code == 200 ]

Alternative EQL for environments with authentication telemetry:

any where http.request.uri contains "renderAttributeView"
  and not user.id == "admin"
  and not http.request.headers.cookie like "*session*"

Note: the first query detects the vulnerable operation immediately followed by a successful 200 response, consistent with the server returning protected rows. The second query flags requests lacking an authenticated session. Adjust the session/cookie field to match your Elastic mapping.

Splunk SPL Query

index=web sourcetype=access_combined
| where uri_path="*renderAttributeView*" OR uri="*renderAttributeView*"
| eval has_auth=if(match(cookie, "(?i)session|token|auth"), "yes", "no")
| where has_auth="no"
| stats count min(_time) max(_time) values(uri) as uris by src_ip, dest_ip, dest_port
| sort - count

Note: this query surfaces unauthenticated requests hitting renderAttributeView, grouped by source IP to reveal scanning or repeated enumeration. If the access log does not capture cookies, replace the has_auth evaluation with a lookup of authenticated source IPs from your authentication logs.

Wazuh OSSEC Rule

<group name="web,">
  <rule id="100728" level="12">
    <decoded_as>web-access</decoded_as>
    <field name="url">.*renderAttributeView.*</field>
    <description>SiYuan CVE-2026-72806: unauthenticated renderAttributeView request detected</description>
    <group>cve-2026-72806,siyuan,authentication-bypass,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <references>
      <reference>https://nvd.nist.gov/vuln/detail/CVE-2026-72806</reference>
    </references>
    <options>no_full_log</options>
  </rule>
</group>

Note: ensure your Wazuh decoder for Apache/Nginx access logs populates the "url" field (the default Wazuh Apache decoder maps the request URI to "url"). If a different field name is populated, substitute accordingly.

Mitigation & Patch Guidance

Patch confidence for this advisory is 0/4 — no tracked source (vendor advisory, commit, or package release) confirms a shipped fix. The NVD description states that SiYuan versions before v3.7.4 are affected, which implies the issue was addressed at v3.7.4, but this could not be independently verified.

1. Immediate mitigations:

   • Disable or remove password-protected attribute views and database views from any published SiYuan content until a fix is verified.
   • Restrict network access to SiYuan instances; do not expose publishing interfaces directly to the internet. Place instances behind a VPN, network allowlist, or reverse proxy with mandatory authentication.
   • Deploy WAF or reverse-proxy rules (adapted from the Sigma/Suricata rules above) to block or alert on unauthenticated requests whose URI or body references renderAttributeView.

2. Patch/upgrade steps:

   • Verify the vendor's current release channel. If SiYuan v3.7.4 or later is available, upgrade all affected instances.
   • As part of upgrade acceptance testing, retest the exact scenario described in the CVE: invoke renderAttributeView against a password-protected view without supplying the password and confirm the rows are no longer returned.
   • Because patch evidence is 0/4, treat any upgraded version with residual suspicion and re-monitor the CVE record for emerging patch confirmations.

3. Long-term hardening:

   • Enforce authentication at the reverse-proxy layer for all publishing operations so unauthenticated requests never reach application logic.
   • Add automated regression tests for the publishing authorization flow (password required for protected attribute views/database rows) to the application upgrade pipeline.
   • Inventory all SiYuan deployments and maintain a register of instances that expose attribute views or database views with password protection, as these are the only affected configurations.
   • Monitor EPSS, CISA KEV, and public exploit repositories for changes; re-evaluate detection rules if exploitation activity appears.

References

1. NVD — CVE-2026-72806: https://nvd.nist.gov/vuln/detail/CVE-2026-72806
2. MITRE CVE Record — CVE-2026-72806: https://www.cve.org/CVERecord?id=CVE-2026-72806
3. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. SiYuan project repository (reference point for pending fix versions): https://github.com/siyuan-note/siyuan
5. CISA Known Exploited Vulnerabilities catalog — CVE-2026-72806 is NOT listed; no known exploitation in the wild as of this report

No threat-actor campaign, exploit-in-the-wild evidence, or public PoC is known for CVE-2026-72806 at the time of writing. Exploitation likelihood is currently low per EPSS (0.00307, 23.4% percentile), but the absence of a confirmed patch warrants defensive attention.