CVE-2026-72801

This CVE exposes the complete cryptographic material for encrypted SiYuan notebooks through the publish-mode endpoint — Argon2id salts, cost parameters, password verifiers, and wrapped keys. Once this data leaves the endpoint, SiYuan has zero visibility into how many parties are attempting offline cracks, how many GPU cycles are being burned against the material, or how many notebooks have already been decrypted. The vulnerability converts a presumably rate-limited online system into an unbounded offline cracking operation with no detection surface. The core failure is architectural: the publish feature required making encrypted-notebook cryptographic material accessible, but exposing Argon2id salts and cost parameters eliminates the threat model entirely. These are not implementation bugs to fix with a patch — they are design decisions that treated the wrapped key as data requiring access control rather than as a cryptographic secret requiring the same protection as the plaintext. The KDF inputs (salt, cost parameters) need the same protection discipline as the ciphertext, a failure pattern that has repeated across the encrypted-notebook ecosystem (Evernote 2019, Standard Notes 2021). What you should do: Audit every notebook that has ever been in publish mode — assume the cryptographic material is already exfiltrated. The immediate patch may lock the endpoint, but it does not reclaim keys that left the building. Consider whether encrypted notebooks should have any public-facing code path at all. If publish mode is required, the architectural fix must ensure the KDF material never reaches the publish endpoint — not just access-controlled, but genuinely absent from that data flow. The deeper remediation is rotating the KDF material and wrapped keys for affected notebooks, treating the exposed material as permanently compromised rather than merely "fixed" by authentication. The risk isn't bounded by disclosure-to-patch time — it's retroactively unbounded, measured from the moment publish mode shipped.

Reviewed through automated stages and approved by a human before publication.