Summary
SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers
CVE: This vulnerability corresponds to CVE-2026-72799.
Five filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false. An anonymous reader can map the complete private document tree every notebook, folder, and document title, and which notebook holds each document for documents marked hidden, password-protected, or publish-forbidden, and can resolve titles to document IDs.
Details
None of the following handlers invokes IsReadOnlyRoleContext, CheckBlockIdAccessableByPublishAccess, or CheckPathAccessableByPublishIgnore:
| Endpoint | Returns | Discloses |
|---|---|---|
getFullHPathByID (router 159) |
GetFullHPathByID(id) |
full title path including notebook, e.g. /MySecretNotebook/Confidential/Q3 Layoffs Plan |
getHPathByID (router 157) |
GetHPathByID(id) |
document-relative title path |
getPathByID (router 158) |
{path, notebook} |
which notebook a document lives in, plus its .sy storage path |
getIDsByHPath (router 160) |
GetIDsByHPath(path, notebook) |
title-path → document-ID enumeration |
getHPathByPath (router 155) |
HPath from a storage path | title path from a storage path |
Each accepts an arbitrary ID or HPath and resolves it identically for hidden, publish-forbidden, and password-protected documents.
This enables two operations for an unauthenticated caller:
- Map the private document tree:
getFullHPathByIDandgetPathByIDyield every notebook/folder/document title and its containing notebook. - Resolve titles to IDs:
getIDsByHPathconverts a known or guessed title path into document IDs, which are the required input for other block-read endpoints.
Document titles and HPaths are precisely the block metadata that the project's block-metadata restriction (commit ffde3b21e) set out to protect; that change gated getBlockInfo, getDocInfo, and getDocsInfo but left this entire path-resolution family open.
Guarded-sibling asymmetry. getRecentDocs (FilterRecentDocsByPublishAccess), getCriteria (FilterCriteriaByPublishAccess), and getLocalStorage (FilterLocalStorageByPublishAccess) all filter document references for reader sessions. The codebase clearly publish-scopes reader-visible metadata elsewhere; these five endpoints do not.
Verified at origin/master (eef105683): all five handler bodies contain no publish-access call; the storage-family siblings contain their filters; all five routes are registered CheckAuth without CheckAdminRole.
Proof of Concept
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false, otherwise any publish reader account. A document exists in a notebook marked publish-forbidden or password-protected.
Resolve a private document's full title path:
POST http://127.0.0.1:6808/api/filetree/getFullHPathByID
{"id":"<DOC_ID>"}
→ /MySecretNotebook/Confidential/Q3 Layoffs Plan
Identify its notebook and storage path:
POST http://127.0.0.1:6808/api/filetree/getPathByID
{"id":"<DOC_ID>"}
→ {"path":"/....sy","notebook":"<BOX_ID>"}
Enumerate IDs from a title path:
POST http://127.0.0.1:6808/api/filetree/getIDsByHPath
{"path":"/Confidential","notebook":"<BOX_ID>"}
→ document IDs under a folder the reader cannot otherwise access
Each returns data for documents excluded from publishing; no password or membership is required.
Impact
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can enumerate the complete private document structure: notebook names, folder hierarchy, and document titles for content the administrator marked hidden, password-protected, or excluded from publishing. Document titles alone are frequently sensitive (project names, personnel actions, client identifiers). The ID-resolution direction additionally supplies valid document IDs, removing the "attacker must know an ID" precondition for other block-read endpoints. Confidentiality-only.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
CVE-2026-72799 has a CVSS score of 5.8 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.0.0-20260724112156-5bae0926b896); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
For IsReadOnlyRoleContext sessions, gate each of the five handlers with CheckBlockIdAccessableByPublishAccess (or restrict resolution to publish-visible documents), mirroring the treatment already applied in getRecentDocs, getCriteria, and getLocalStorage.
Frequently Asked Questions
- What is CVE-2026-72799? CVE-2026-72799 is a medium-severity missing authorization vulnerability in github.com/siyuan-note/siyuan/kernel (go), affecting versions < 0.0.0-20260724112156-5bae0926b896. It is fixed in 0.0.0-20260724112156-5bae0926b896. The application does not perform an authorization check before performing a sensitive operation.
- How severe is CVE-2026-72799? CVE-2026-72799 has a CVSS score of 5.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/siyuan-note/siyuan/kernel are affected by CVE-2026-72799? github.com/siyuan-note/siyuan/kernel (go) versions < 0.0.0-20260724112156-5bae0926b896 is affected.
- Is there a fix for CVE-2026-72799? Yes. CVE-2026-72799 is fixed in 0.0.0-20260724112156-5bae0926b896. Upgrade to this version or later.
- Is CVE-2026-72799 exploitable, and should I be worried? Whether CVE-2026-72799 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-72799 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-72799? Upgrade
github.com/siyuan-note/siyuan/kernelto 0.0.0-20260724112156-5bae0926b896 or later.