CVE-2026-72792: Information Disclosure via Tag API Endpoint in SiYuan

SiYuan is an open-source, local-first personal knowledge management system that supports fine-grained content publishing. When hosting published notebooks, users can password-protect specific documents to prevent unauthorized read access. This security control is bypassed by an incorrect authorization defect in the tag aggregation API endpoint.

The vulnerability, tracked as CVE-2026-72792, resides within the /api/tag/getTag endpoint. When the application runs in public publish mode, unauthenticated remote attackers can query this endpoint to retrieve structural metadata. The endpoint returns tag labels and occurrence counts originating from password-protected documents without validating the user's authorization status.

The underlying flaw is categorized as CWE-863 (Incorrect Authorization). By exploiting this behavior, an attacker can map sensitive vocabulary, internal terminology, and proprietary metadata. This compromises the confidentiality boundaries established by the notebook author.

The root cause of CVE-2026-72792 is a logical omission during authorization checks in the tag processing workflow. The core logic handles read-only requests by retrieving document visibility states. However, it fails to evaluate whether target documents are protected by passwords.

When a client queries /api/tag/getTag, the server determines if the request context represents a restricted public reader. If this evaluation evaluates to true, the application filters the returned tag array. The legacy filtering logic relied on the FilterTagsByPublishIgnore function, which only inspected if document paths were explicitly marked as invisible or completely unpublished.

Because the system omitted checks for password-protection states during this aggregation, database queries extracted tag spans across all published documents. The application compiled these tags and served the structured response directly to unauthenticated visitors. The system assumed that because a document was published, its tag structure was public, neglecting the access restriction enforced by the document's password.

To understand the technical mechanics, compare the insecure implementation with the corrected logic implemented in version v3.7.4. The legacy implementation in kernel/model/publish_access.go was structured as follows:

// Legacy Vulnerable Filter in kernel/model/publish_access.go
func FilterTagsByPublishIgnore(publishIgnore PublishAccess, tags *Tags) (ret *Tags) {
    spans := sql.QueryTagSpans("")
    labelCounts := make(map[string]int)
    for _, span := range spans {
        // Only checks if the document is ignored or invisible
        if CheckPathAccessableByPublishIgnore(span.Box, span.Path, publishIgnore) {
            label := util.UnescapeHTML(span.Content)
            labelCounts[label] += 1
        }
    }
    ret = &Tags{}
    // ... constructs and returns tags
}

The patch introduced FilterTagsByPublishAccess to properly enforce authorization checks based on session cookies. The corrected implementation validates the existence of active password sessions:

// Patched Implementation (v3.7.4+)
func filterTagsByPublishAccess(c *gin.Context, publishAccess PublishAccess, tags *Tags, spans []*sql.Span) (ret *Tags) {
    publishInvisible := GetInvisiblePublishAccess(publishAccess)
    publishDisable := GetDisablePublishAccess(publishAccess)
    labelCounts := make(map[string]int)
    for _, span := range spans {
        // 1. Verify document path is neither invisible nor disabled
        if !CheckPathAccessableByPublishIgnore(span.Box, span.Path, publishInvisible) ||
            !CheckPathAccessableByPublishIgnore(span.Box, span.Path, publishDisable) {
            continue
        }
        // 2. Retrieve password configuration for the document path
        passwordID, password := GetPathPasswordByPublishAccess(span.Box, span.Path, publishAccess)
        // 3. Enforce auth check if password protection is enabled
        if password != "" && !CheckPublishAuthCookie(c, passwordID, password) {
            continue
        }
        label := util.UnescapeHTML(span.Content)
        labelCounts[label] += 1
    }
    ret = &Tags{}
    // ... constructs and returns authorized tags
}

By querying GetPathPasswordByPublishAccess and applying CheckPublishAuthCookie, the patched engine discards tag nodes when the requesting client has not provided the correct document password.

Exploitation of CVE-2026-72792 requires no authentication and can be completed via simple HTTP requests. An attacker first scans for a target SiYuan notebook server operating in publish mode. The attacker then targets the endpoint /api/tag/getTag using standard HTTP clients.

The request payload consists of an empty JSON object sent via a POST request. The server parses the request and initiates the database query to aggregate tag spans. Because the vulnerable server does not check document-level passwords, the database retrieves and returns all tags.

POST /api/tag/getTag HTTP/1.1
Host: target.siyuan.instance
Content-Type: application/json
 
{}

The response contains a JSON payload containing tag labels and their total occurrence counts. Even if a document named Secret_Project_Plan.sy is password-protected, labels like Project-Mercury, merger-target-corp, or vulnerability-disclosures are leaked. This allows the attacker to reconstruct the outline, vocabulary, and contents of the protected workspace.

The security impact of CVE-2026-72792 is defined as low-to-moderate information disclosure. While the vulnerability does not directly permit remote code execution, it leaks internal metadata that can facilitate highly targeted attacks or expose confidential business strategies.

Beyond metadata leakage, an analysis of the patch reveals potential cryptographic weaknesses in how SiYuan authorizes readers. The helper function CheckPublishAuthCookie verifies access by checking a client-supplied cookie value against a SHA-256 hash. This hash is constructed deterministically from predictable components:

$$\text{Cookie Value} = \text{SHA256}(\text{Document ID} + \text{Document Password})$$

Because the application uses a static SHA-256 hash without an application-wide salt or dynamic session state, it is vulnerable to offline dictionary attacks. If an attacker recovers the document ID from the public interface, they can generate candidate password hashes offline. Once they match the cookie signature, they bypass document access controls completely.

The primary remediation path for CVE-2026-72792 is upgrading the SiYuan application to version v3.7.4 or later. This version replaces the insecure tag aggregation flow with authenticated path validation.

Administrators who cannot immediately upgrade should implement temporary access restrictions. Disable publish mode completely if sensitive documents are hosted on the instance. Alternatively, configure reverse proxies or Web Application Firewalls (WAF) to block external access to /api/tag/getTag and other administrative API endpoints.

# Nginx block rule example
location = /api/tag/getTag {
    deny all;
    return 403;
}

Reviewing the integrity of active document passwords is also recommended. Since the authorization cookies are generated deterministically, administrators must ensure that password-protected notebooks use strong, high-entropy passwords to prevent offline brute-force attacks on the SHA-256 cookie generation routine.