CVE-2026-72801: Information Disclosure of Cryptographic Key Material in SiYuan

SiYuan is a local-first personal knowledge management platform that supports end-to-end encrypted notebooks to ensure data privacy. Users rely on a zero-trust model where data remains encrypted on disk and during synchronization. To facilitate collaboration, the application provides a Publish Mode, which lets users expose specific notebooks as public-facing websites directly from their instances.

When Publish Mode is active, the application exposes a public web server and web routing layer to anonymous clients over the network. This architecture changes the authorization rules for content-rendering endpoints. However, it also exposes administrative configuration interfaces if the routing engine does not strictly separate public rendering logic from private data structures.

This vulnerability lies in the exposure of endpoints handling notebook configuration and cryptographic structures. Because the access control middleware does not properly segment these endpoints, unauthenticated remote attackers can query administrative APIs. This creates a significant information disclosure attack surface, yielding the precise parameters required to target the user's master cryptographic key.

The root cause of CVE-2026-72801 is a logical access control flaw in the web routing configuration of the SiYuan platform. In versions prior to v3.7.4, the application uses an authentication middleware layer, commonly designated as CheckAuth, to validate requests. Under normal operating conditions, this middleware blocks unauthenticated requests to the /api/ routing tree.

When Publish Mode is toggled on, the application dynamically reconfigures route access rules to allow anonymous visitors to view published pages. The application's router fails to maintain a strict allowlist for public routes, instead permitting broader access to administrative endpoints. Specifically, the endpoints /api/notebook/getNotebookConf and /api/notebook/getNotebooks are left accessible to unauthenticated HTTP requests.

Furthermore, the serialization logic of the notebook configuration handler does not filter or sanitize output fields based on the caller's authorization level. When these endpoints are queried, they serialize the entire internal notebook configuration struct into a JSON payload. This struct contains highly sensitive fields that define the cryptographic container's access controls, returning them directly to the anonymous client.

To understand the severity of the disclosure, one must examine SiYuan's underlying key-derivation and data-protection design. SiYuan protects notebooks using a derived master key and a wrapped Data Encryption Key (DEK). The master key is derived from a user-supplied master password using the Argon2id key derivation function.

The system configuration stores the specific parameters used during this derivation process. The leaked JSON payload includes the salt (the unique salt bytes utilized to prevent precomputation attacks), timeCost (iteration count), memoryCost (RAM usage parameter), and parallelism (thread allocation). These parameters are required to reconstruct the exact Argon2id hash space.

In addition to Argon2id parameters, the disclosure leaks the verifier and the wrappedKey. The verifier is a cryptographic hash used to confirm locally whether a user has entered the correct master password. The wrappedKey is the AES-encrypted DEK, which was wrapped using the derived master key. Armed with these components, an attacker possesses every piece of metadata required to perform an offline brute-force attack against the master password.

Exploitation of this vulnerability is straightforward and requires only basic web requests. An attacker targets an active SiYuan instance running in Publish Mode by sending an HTTP POST request to /api/notebook/getNotebooks to discover available notebook identifiers. No session cookies, API tokens, or headers are required to obtain this list.

Once the notebook identifier is retrieved, the attacker queries /api/notebook/getNotebookConf with the target notebook ID. The server responds with a 200 OK status and a JSON payload containing the cryptographic parameters. The attacker extracts the base64-encoded salt, the integer cost metrics, the hex-encoded verifier, and the wrappedKey payload.

Because the attacker performs the brute-force calculations locally on high-throughput GPU hardware, they bypass all network-level rate limits, logging mechanisms, and account lockout protections. The attacker executes a dictionary attack, hashing candidate passwords through Argon2id with the disclosed parameters and comparing the output to the extracted verifier. Once a match is found, the attacker derives the master key, decrypts the wrappedKey to recover the plaintext DEK, and decrypts the entire notebook database offline.

The impact of CVE-2026-72801 is a complete compromise of confidentiality for all encrypted data stored within the affected SiYuan notebooks. Since personal knowledge management systems are often used to store credentials, private encryption keys, intellectual property, and personal identification records, the downstream impact of this leakage is severe.

The attack vector is classified as Network (AV:N) with Low Attack Complexity (AC:L) and requires zero Privileges (PR:N) or User Interaction (UI:N). The CVSS v4.0 score of 8.7 reflects that while the attack itself only discloses information (VC:H, VI:N, VA:N), the disclosed information is of a cryptographic nature that directly facilitates the complete exposure of the encrypted filesystem.

Traditional online defenses such as Web Application Firewalls (WAFs) and IP-based rate limiting are ineffective once the metadata is stolen. Because the computationally intensive cracking process occurs entirely on systems controlled by the adversary, the time to compromise is limited only by the strength and complexity of the user's master password.

The definitive remediation for this vulnerability is to upgrade the SiYuan installation to version v3.7.4 or later. In version v3.7.4, the development team updated the routing configurations to ensure that the CheckAuth middleware is strictly applied to the endpoints /api/notebook/getNotebookConf and /api/notebook/getNotebooks, blocking anonymous access even when Publish Mode is enabled.

If upgrading immediately is not possible, system administrators must implement external mitigation controls. The most effective workaround is to disable the Publish Mode feature entirely within the application settings. Alternatively, administrators can configure a reverse proxy such as Nginx, Apache HTTP Server, or Caddy to intercept and block all external requests targeting the /api/ path.

Because cryptographic parameters may have been scraped prior to patch application, upgrading the software is only the first step. If an instance was exposed to the public Internet while vulnerable, users should assume their cryptographic metadata has been compromised. After upgrading to v3.7.4, users must rotate their notebook master passwords to generate a new Argon2id salt, verifier, and wrapped database key.