WebSocket bug can expose secrets

Published September 3, 2026 CVE-2026-72810

The flaw affects WebSocket before v3.7.4 and has a security flaw.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 0.0.0-20260723013612-ba948639d7f6Fix recorded on Aug 26, 2026
Affected versions
before 0.0.0-20260723013612-ba948639d7f6
Weakness
CWE-862Missing Authorization
Exploit likelihood
0.31% in 30 daysEPSS, higher than 24% of known flaws
Affects
WebSocket

How it works

WebSocket bug can expose secrets SiYuan versions older than v3.7.4 contain a publish-boundary bypass vulnerability in WebSocket broadcast sessions that allows anonymous readers to receive unfiltered edits.

What to do

Check whether the installed WebSocket version is older than v3.7.4.

Update WebSocket to v3.7.4 or newer. Then verify the installed version.

Technical details

The source identifies WebSocket as the affected product. Affected ranges: before v3.7.4. Fixed versions: v3.7.4.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source