CVE-2026-72810

This vulnerability in SiYuan's WebSocket handling isn't a case of missing security logic—the logic existed and worked for HTTP requests. What failed was far more structural: that authorization layer was never replicated for the WebSocket subscription channel, creating a silent bypass where password-protected and forbidden documents leak to anyone with an authenticated WebSocket connection. The real severity isn't captured by CVSS alone. A single WebSocket connection established after authentication can passively receive document content indefinitely—no burst, no anomalous HTTP requests, no log spike. An attacker monitoring a shared knowledge base could exfiltrate months of internal planning, forbidden drafts, and explicitly restricted documents without triggering any detection. This is fundamentally different from a traditional CVE where data leaves in a noticeable burst. The blast radius is cumulative and silent. The low EPSS (0.00313) likely reflects exploit sophistication (you need to maintain a connection rather than fire a payload), but it understates actual risk in environments where SiYuan runs as a collaborative knowledge base with sensitive internal documents. The question isn't whether anonymous readers were expected on the publish surface—the violation is that the authorization logic existed elsewhere and simply wasn't applied here. What to do: First, verify whether SiYuan requires authentication to establish the WebSocket connection itself. If authentication is required at connection time but content filtering is absent, you have exactly this bypass. Second, audit your WebSocket traffic for unexpected document content—look for long-lived connections originating from untrusted sources. Third, assume the vulnerability was actively exploited in any environment running unpatched SiYuan for months; review historical WebSocket connections for indicators of monitoring. Fourth, check whether the patch shared middleware with HTTP handlers or patched auth directly into WebSocket code—the latter creates ongoing maintenance risk where future channels could miss the same check.

Reviewed through automated stages and approved by a human before publication.