Is CVE-2026-72795 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72795 being exploited in the wild.

How severe is CVE-2026-72795?

High severity, with a CVSS score of 8.6, published 12 August 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260725125659-1ca1c3c9d94b, SEMVER:introduced=0,fixed=0.0.0-20260725125659-1ca1c3c9d94b.

Is there a fix for CVE-2026-72795?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725125659-1ca1c3c9d94b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72795 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-72795?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72795: SiYuan embedded block content leak via missing publish-access filtering

Q: Is there a fix for CVE-2026-72795?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725125659-1ca1c3c9d94b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-72795 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-72795?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72795 · Severity: high · CVSS 8.6 · Published 2026-08-12

SiYuan is a popular note-taking and knowledge management application that supports publishing documents for sharing with readers. When published documents contain embedded queries (transclusions) that pull content from other blocks, the API endpoints handling these embeds fail to apply access control to the embedded content itself. This allows anonymous readers or any reader with limited access to view the full HTML content of blocks in private, hidden, or password-protected documents by requesting a publicly-shared document that happens to reference them via an embed query.

Technologies: github.com/siyuan-note/siyuan/kernel (Go). Vendors: Go.

Quick answers

Is CVE-2026-72795 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72795 being exploited in the wild.
How severe is CVE-2026-72795?: High severity, with a CVSS score of 8.6, published 12 August 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260725125659-1ca1c3c9d94b, SEMVER:introduced=0,fixed=0.0.0-20260725125659-1ca1c3c9d94b.
Is there a fix for CVE-2026-72795?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725125659-1ca1c3c9d94b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72795 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-72795?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725125659-1ca1c3c9d94b or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260725125659-1ca1c3c9d94b
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in the block DOM retrieval endpoints. The affected routes are `POST /api/block/getBlockDOMWithEmbed` and `POST /api/block/getBlockDOMsWithEmbed` in `kernel/api/router.go`, which are gated only by `model.CheckAuth` middleware, allowing access by RoleReader tokens and anonymously when `Publish.Auth.Enable` is false. The leak occurs in the `resolveEmbedContentInBox` function (`kernel/model/block.go:976`), which processes NodeBlockQueryEmbed nodes, executes SQL queries to fetch matched blocks, and inlines their content HTML via `SetIALAttr("embed-content", ...)` without applying any `publishAccess` filtering. In contrast, the sibling endpoint `getEmbedBlock` correctly applies `FilterEmbedBlocksByPublishAccess` to the same query results. No authentication bypass is required; the attack exploits the published nature of the requested block (which passes the top-level gate) to reach unfiltered embedded content. The PoC demonstrates requesting a published block containing an embed query, which returns private block content in the response DOM. A patch has been released in version 0.0.0-20260725125659-1ca1c3c9d94b.

Affected products

siyuan-note siyuan < 0.0.0-20260725125659-1ca1c3c9d94b

Identifiers

CVE-2026-72795
GHSA-h6w7-xxcf-w2mq
GO-2026-6425

Timeline

2026-07-25: disclosed: Vulnerability published to GitHub Advisory Database
2026-07-25: patched: Patch released in commit 1ca1c3c9d94b
2026-09-04: advisory: Advisory GHSA-h6w7-xxcf-w2mq and CVE-2026-72795 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.