Is CVE-2026-72798 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72798?

CVE-2026-72798 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-72798

Description

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.