Medium severity · published Aug 12, 2026
CVE-2026-72806
SiYuan before v3.7.4 Authentication Bypass via Attribute View
5.8
CVSS
0.4%
EPSS
No
On KEV
Description
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.7.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72806
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72806
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP