CVE-2026-72810

CVE-2026-72810 is a missing-authorization flaw (CWE-862) in SiYuan's publish mode: WebSocket sessions admitted through the publish surface on port 6808, including anonymous RoleReader sessions when Publish.Auth.Enable is false, are registered into the same broadcast session pool as authenticated sessions, and the kernel's broadcast functions push content events to every pooled session without any role or publish-access filtering. An attacker needs no credentials: they connect to the /ws route on the publish port and hold the socket open while any user edits documents. The attacker then passively receives a real-time feed of all edit events, including transactions with rendered block DOM, document create/save, and move/rename events, covering password-protected, publish-forbidden, and unpublished documents; because these events are pushed directly from the edit pipeline, none of the HTTP publish-access filters apply. Any SiYuan deployment with publish mode enabled on port 6808 is exposed, with anonymous access sufficient when publish authentication is disabled, as demonstrated in the reported local reproduction. No exploitation is currently reported: there is no known public PoC or in-the-wild use, the issue is not in CISA KEV, and EPSS assigns it a 0.3% probability of exploitation in the next 30 days.

What to do: Until a patched release is available, restrict network access to the publish port (6808) at the firewall or reverse proxy and enable publish authentication (Publish.Auth.Enable) so anonymous WebSocket clients cannot connect to /ws. Because the leak bypasses the HTTP publish-access filters entirely, verify that password-protected, publish-forbidden, or confidential notebooks are not present in workspaces being published, and monitor the vendor for a fixed version.