# CVE-2026-72796: SiYuan static routes access control bypass

Source: https://junglewise.ai/threats/cve-2026-72796-siyuan-static-routes-access-control-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72796 · Severity: medium · CVSS 5.8 · Published 2026-08-12

SiYuan is a note-taking and knowledge management application that supports a publish mode for sharing content. Static file routes in the server bypass the access control rules enforced on the REST API, allowing unauthorized readers to access restricted templates, snippets, export artifacts, and plugin/widget directories. This exposes sensitive user-authored documents and configuration that should only be available to administrators.

Technologies: [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel), [SiYuan](https://junglewise.ai/threats/technologies/siyuan). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SiYuan](https://junglewise.ai/threats/vendors/siyuan).

## Quick answers

**Is CVE-2026-72796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72796 being exploited in the wild.

**How severe is CVE-2026-72796?** Medium severity, with a CVSS score of 5.8, published 12 August 2026.

**Which products and versions are affected?** github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260725122641-34be6c0bb073, SEMVER:introduced=0,fixed=0.0.0-20260725122641-34be6c0bb073; SiYuan < 0.0.0-20260725122641-34be6c0bb073.

**Is there a fix for CVE-2026-72796?** Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72796 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-72796?** Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260725122641-34be6c0bb073 or later

  ```sh
  go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260725122641-34be6c0bb073
  ```


## Technical details

The vulnerability is a missing authorization check (CWE-862) in static file routes within kernel/server/serve.go. Four route groups are affected: /templates/, /snippets/, /widgets/+/plugins/+/emojis/, and /export/. All are registered with CheckAuth guard only, lacking the publish-access scoping and sensitive-path checks (/IsSensitivePath) that parallel REST API endpoints enforce. Most notably, /templates/ directly contradicts existing controls: the REST file API explicitly blocks data/templates/ to non-administrators via refuseToAccess (kernel/api/file.go:551-553), but the static route serves it to any RoleReader. Similarly, /export/ allows readers to retrieve exported content (PDF/HTML/DOCX/CSV) of arbitrary documents by exploiting predictable naming (e.g., export/csv/<doc-name>/<doc-name>.csv). The /assets/* route correctly implements CheckAbsPathAccessableByPublishAccess; /export/ carries DEK and traversal guards but omits the publish-access gate. Attack vector is network with no authentication required in anonymous mode. The patch (commit 34be6c0) applies equivalent authorization checks to static routes as their REST counterparts.

## Affected products

- siyuan-note siyuan < 0.0.0-20260725122641-34be6c0bb073

## Identifiers

- CVE-2026-72796
- GHSA-fgmr-7w36-9qfq
- GO-2026-6423

## Timeline

- 2026-07-25: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-09-04: advisory: GitHub Security Advisory GHSA-fgmr-7w36-9qfq published
- 2026-09-04: patched: Fix released as commit 34be6c0bb0739d5b8e99ecc0cbfb474abb16230d

## References

- [https://api.github.com/users/Shirshakhtml](https://api.github.com/users/Shirshakhtml)
- [https://github.com/Shirshakhtml](https://github.com/Shirshakhtml)
- [https://api.github.com/users/Shirshakhtml/gists%7B/gist_id%7D](https://api.github.com/users/Shirshakhtml/gists%7B/gist_id%7D)
- [https://api.github.com/users/Shirshakhtml/repos](https://api.github.com/users/Shirshakhtml/repos)
- [https://avatars.githubusercontent.com/u/75179984?v=4](https://avatars.githubusercontent.com/u/75179984?v=4)
- [https://api.github.com/users/Shirshakhtml/events%7B/privacy%7D](https://api.github.com/users/Shirshakhtml/events%7B/privacy%7D)

## Related threats

- [SiYuan path traversal in web fetch](https://junglewise.ai/threats/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal)
- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path traversal via GLOBALROOT alias bypass](https://junglewise.ai/threats/cve-2026-118680-siyuan-3-8-7-through-3-8-8-fails-to-normalize-windows-globalroot)
- [SiYuan SQL injection in history search](https://junglewise.ai/threats/cve-2026-116170-siyuan-before-v3-8-7-contains-an-sql-injection-vulnerability)
- [SiYuan cross-site scripting in /check-auth redirect](https://junglewise.ai/threats/cve-2026-116167-siyuan-from-2-9-0-before-3-8-7-contains-a-cross-site-scripting)