CVE-2026-72798: siyuan 0 to before 3.7.4

Affected technology

siyuan · 0 to before 3.7.4
siyuan-note

Description’s affected range: versions before v3.7.4 fail to properly filter related-database content in renderAttributeView

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type. Vendor/CNA’s CVSS 4.0 assessment (base score 9.2/10) rates confidentiality impact as high; integrity and availability impact as none.