CVE-2026-72797

CVE-2026-72797 exposes a design failure in the SiYuan note-taking application where the getEncryptedNotebookStatus endpoint returns lock state and notebook identifiers to any caller with publish-mode access, regardless of whether they have decryption keys for the content. The vulnerability isn't a missing encryption implementation—it's a missing access control layer on top of encryption. When developers treat 'encrypted' as synonymous with 'secure from all disclosure vectors,' they create a category error: encryption protects content, but metadata about encrypted objects (their names, their lock states, their presence in the system) has independent sensitivity that requires separate filtering. This matters because encrypted notebook names reveal what topics exist in an organization and what knowledge is being protected. More critically, the lock state exposes whether a notebook is currently unlocked in memory—an attacker who knows the precise moment a notebook becomes accessible has a targeted window for access attempts or exfiltration. This isn't theoretical; the pattern of treating encryption as a complete security boundary while leaving metadata unexamined has recurred across AWS S3 configurations, MongoDB deployments, Signal's early architecture, and multiple note-taking applications. Each instance follows the same arc: the endpoint was correct for an earlier deployment context (single-user local instance), the system evolved (publish-mode added, user base diversified), but nobody re-examined the endpoint's implicit threat model against the new reality. Audit your SiYuan deployment immediately: enumerate all API endpoints callable by publish-mode or anonymous users and verify they return no information about encrypted objects the caller cannot decrypt. Extend this audit beyond SiYuan to any system where you consume encrypted content from a shared API—check whether endpoints that predate your current access control model expose metadata about objects you can't access. The remediation isn't just adding role-based filtering to one endpoint; it's auditing every pre-existing endpoint for context drift—code written for deployment model A that now operates in deployment model B without security re-review. The threat actors already have the playbook for this pattern. They're not waiting for CVEs to exploit it.

Reviewed through automated stages and approved by a human before publication.