Is CVE-2026-72810 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72810?

CVE-2026-72810 has a CVSS v3 severity of HIGH (8.6).

Back

CVE-2026-72810

Description

SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.