Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and template expressions. Additionally, getBlockDefIDsByRefText and getBlockRelevantIDs endpoints enumerate workspace-wide block IDs without publish scoping, enabling attackers to discover valid block identifiers across publish boundaries and access content from hidden or password-protected documents.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 Anytype, Information Disclosure via Authorization Bypass, #CVE-2026-72800 (Medium) -DC-Sep2026-2187 https://dailycve.com/anytype-information-disclosure-via-authorization-bypass-cve-2026-72800-medium-dc-sep2026-2187/
Post summary
An announcement of Anytype's information disclosure vulnerability (CVE-2026-72800) with medium severity is made, indicating an authorization bypass that could lead to data exposure.