CVE-2026-72800

CVE-2026-72800 exposes a systematic authorization failure in SiYuan's publish/private boundary, and the CVSS 5.8 score badly understates the real risk. Three endpoints—getBlockDefIDsByRefText and two related schema enumeration APIs—allow authenticated users to enumerate block IDs and schema definitions across publish boundaries, including content behind password protection. That's not three independent oversights; it's evidence of a structural gap where the publish boundary was bolted onto the UI layer but never enforced at the API routing layer. Here's why this matters beyond the CVE description: block IDs in a knowledge management system aren't random tokens—they're the connective tissue of the entire workspace, often sequential or predictable within a vault. An attacker who enumerates them doesn't get a scattered list; they get a systematic map of content topology that persists as a permanent oracle. That oracle then transforms every other endpoint accepting a block ID parameter into a targeted weapon—enumerate first, then probe retrieval and display endpoints to pull content that should have been hidden. The practical question for defenders isn't whether to patch (you must). It's whether this represents a three-endpoint fix or evidence of a systemic gap. Check the patch diff: if the fix was surgical—three lines added to three endpoints—that confirms the authorization layer lacks centralized enforcement, and other unpublished endpoints almost certainly have the same gap. If the fix refactored underlying middleware, the architecture may be more sound than the CVE suggests. Immediate priorities: audit every endpoint that accepts a block ID as input and verify it enforces publish boundaries. Review logs for anomalous block ID enumeration patterns from internal accounts. If SiYuan stores sensitive enterprise data behind password-protected documents, treat this as a high-severity incident regardless of the CVSS rating—the score measures the enumeration bug, not what an attacker can do with the oracle it creates.

Reviewed through automated stages and approved by a human before publication.