SiYuan encrypted notes leak passwords

Published September 3, 2026 CVE-2026-72801

SiYuan, a private note-taking app, leaks encryption keys from locked notes. Attackers who steal a SiYuan file can crack your master password offline and read all your notes.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 0.0.0-20260724102025-3bc014c7dc32Fix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260724102025-3bc014c7dc32
Weakness
CWE-522Insufficiently Protected Credentials
Exploit likelihood
0.24% in 30 daysEPSS, higher than 15% of known flaws
Affects
SiYuan

How it works

  • SiYuan saves encrypted notes in a single file.
  • If an attacker gets that file, they can extract the encryption keys for each note and try to guess your master password offline.

What to do

Check whether the installed SiYuan version is older than 3.7.4.

Update SiYuan to 3.7.4 or newer. Then verify the installed version.

Technical details

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking. CVE: This vulnerability corresponds to CVE-2026-72801.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source