Is CVE-2026-72796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72796 being exploited in the wild.

How severe is CVE-2026-72796?

Medium severity, with a CVSS score of 5.8, published 12 August 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260725122641-34be6c0bb073, SEMVER:introduced=0,fixed=0.0.0-20260725122641-34be6c0bb073; SiYuan < 0.0.0-20260725122641-34be6c0bb073.

Is there a fix for CVE-2026-72796?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-72796 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-72796?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72796: SiYuan static routes access control bypass

Q: Is there a fix for CVE-2026-72796?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-72796 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-72796?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72796 · Severity: medium · CVSS 5.8 · Published 2026-08-12

SiYuan is a note-taking and knowledge management application that supports a publish mode for sharing content. Static file routes in the server bypass the access control rules enforced on the REST API, allowing unauthorized readers to access restricted templates, snippets, export artifacts, and plugin/widget directories. This exposes sensitive user-authored documents and configuration that should only be available to administrators.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-72796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72796 being exploited in the wild.
How severe is CVE-2026-72796?: Medium severity, with a CVSS score of 5.8, published 12 August 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260725122641-34be6c0bb073, SEMVER:introduced=0,fixed=0.0.0-20260725122641-34be6c0bb073; SiYuan < 0.0.0-20260725122641-34be6c0bb073.
Is there a fix for CVE-2026-72796?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72796 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-72796?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260725122641-34be6c0bb073
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in static file routes within kernel/server/serve.go. Four route groups are affected: /templates/, /snippets/, /widgets/+/plugins/+/emojis/, and /export/. All are registered with CheckAuth guard only, lacking the publish-access scoping and sensitive-path checks (/IsSensitivePath) that parallel REST API endpoints enforce. Most notably, /templates/ directly contradicts existing controls: the REST file API explicitly blocks data/templates/ to non-administrators via refuseToAccess (kernel/api/file.go:551-553), but the static route serves it to any RoleReader. Similarly, /export/ allows readers to retrieve exported content (PDF/HTML/DOCX/CSV) of arbitrary documents by exploiting predictable naming (e.g., export/csv/<doc-name>/<doc-name>.csv). The /assets/* route correctly implements CheckAbsPathAccessableByPublishAccess; /export/ carries DEK and traversal guards but omits the publish-access gate. Attack vector is network with no authentication required in anonymous mode. The patch (commit 34be6c0) applies equivalent authorization checks to static routes as their REST counterparts.

Affected products

siyuan-note siyuan < 0.0.0-20260725122641-34be6c0bb073

Identifiers

CVE-2026-72796
GHSA-fgmr-7w36-9qfq
GO-2026-6423

Timeline

2026-07-25: disclosed: Vulnerability published by GitHub Advisory Database
2026-09-04: advisory: GitHub Security Advisory GHSA-fgmr-7w36-9qfq published
2026-09-04: patched: Fix released as commit 34be6c0bb0739d5b8e99ecc0cbfb474abb16230d

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.