CVE-2026-72808

The CVE describes an authorization bypass in SiYuan's annotation endpoint, but the deeper issue is architectural: the codebase conflates authentication with authorization, treating 'am I logged in' as equivalent to 'does this document allow access.' This pattern has recurred across Django, Rails, Express, and Spring—not because developers are careless, but because authentication checks are built into frameworks while authorization logic requires understanding domain-specific access policies. SiYuan's publish system defines three distinct access categories (publish-forbidden, password-protected, unpublished), and the /assets/* route correctly enforces all three. But /api/asset/getFileAnnotation only checks authentication, allowing any authenticated user to read annotations on documents they shouldn't access. The v3.7.4 patch likely hardens this endpoint, but the real question is whether other endpoints carry the same gap. CheckAuth-as-authorization-proxy is a documented anti-pattern precisely because it scales poorly—each new endpoint inherits the cognitive shortcut, creating a distributed authorization gap invisible until specific paths are audited. Prioritization matters more than the CVSS 5.8 suggests: annotations contain the intellectual work itself, often more sensitive than the documents they annotate. If asset paths are enumerable across notebooks, this becomes bulk intellectual property exfiltration against users who disabled publish authentication—trusting SiYuan's architecture to protect what the UI explicitly allows. Audit your SiYuan deployment for other CheckAuth-only endpoints, and treat this CVE as evidence of a class of vulnerability rather than an isolated fix.

Reviewed through automated stages and approved by a human before publication.