CVE-2026-72810
HIGH
NVD
CVSS Score
8.6
Severity
HIGH
Published
Aug 14, 2026
Vendor
unknown
Description
SiYuan versions before v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits. Attackers can establish a WebSocket connection to the publish surface and passively receive real-time content events including password-protected and forbidden documents without authentication.