CVE-2026-72809: siyuan 0 to before 3.7.4

Affected technology

siyuan · 0 to before 3.7.4
siyuan-note

Description’s affected range: versions <= v3.7.2 (patched in v3.7.4)

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

The source says if the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality and availability impact as high; integrity impact as low.