SiYuan: Publish-boundary bypass via WebSocket broadcast: anonymous readers...

Executive Summary

**CVE:** This vulnerability corresponds to [CVE-2026-72810](https://nvd.nist.gov/vuln/detail/CVE-2026-72810). ### Summary WebSocket sessions established through the publish surface (port 6808, `RoleReader` anonymous when `Publish.Auth.Enable` is `false`) are added to the same broadcast session pool . Full analysis, Sigma/YARA rules, IOCs, Attack Chain by CYBERDUDEBIVASH SENTINEL APEX v4.0.

Key Judgements

Key Judgements are derived from validated ReportX claim identifiers rather than a second free-form model request. They may prioritize validation and collection, but they do not convert source-reported claims into confirmed customer impact.

Verified Facts

• Source publisher: CYBERDUDEBIVASH
• Source published: 2026-09-03T23:02:13+00:00

Threat Classification

Report family: CVE Vulnerability Advisory. Exploitation state: Unknown — source record does not confirm active exploitation. Remediation state: Availability not established in the source record — verify vendor guidance. These labels come from the normalized report context and remain bounded by cited evidence.

Threat Severity Assessment

Severity is interpreted from structured scoring or source evidence when present. No customer-specific risk score, blast radius, or compromise state is inferred by this compiler.

Evidence & Source Assessment

Primary provenance is CYBERDUDEBIVASH. The compiler distinguishes source-reported material from independently structured NVD/CISA/EPSS evidence when those fields are actually present.

Timeline & Chronology

The normalized source publication timestamp is 2026-09-03T23:02:13+00:00. Additional intrusion, exploitation, disclosure, or remediation timestamps are not asserted unless they are present in the cited evidence body below.

Business Impact

Customer-specific business impact is not established by a public source record alone. Decision value comes from determining whether relevant assets, identities, dependencies, or services are actually present and exposed.

Enterprise Exposure Assessment

• Inventory and ownership teams should determine whether the technology or service named in the cited record exists in the environment before assigning incident status.
• A positive exposure determination requires asset, version, identity, dependency, cloud/SaaS, or equivalent internal telemetry that can be tied to the cited condition.
• A negative determination should record the inventory evidence and timestamp used so the decision can be revalidated if the source record changes.

Technical Analysis

elements (8+ useful words each) - At least 18 substantive

CVE-2026-72810 is a publish-boundary bypass vulnerability in the SiYuan note-taking and knowledge management application that allows anonymous readers to receive an unfiltered, real-time broadcast feed of all document edits, including protected and forbidden documents. The vulnerability arises because WebSocket sessions established through the publish surface on port 6808 are added to the same broadcast session pool as authenticated sessions when Publish.Auth.Enable is set to false. This architectural conflation of trust boundaries enables information disclosure of content that should remain restricted to authorized users.

The vulnerability was published by CYBERDUDEBIVASH on 2026-09-03 and corresponds to CVE-2026-72810 as recorded in the NVD. Active exploitation status is not established in cited evidence. The KEV catalog status is not established in cited evidence. Organizations deploying SiYuan with publish mode enabled and authentication disabled for the publish surface should assess exposure immediately, as the vulnerability affects the fundamental isolation between anonymous read access and privileged document content.

• The vulnerability represents a trust-boundary conflation between anonymous publish readers and authenticated broadcast sessions within the SiYuan kernel.
• Information disclosure of protected and forbidden documents is the primary impact, as anonymous readers receive a live unfiltered feed of all edits.
• Active exploitation is not established in cited evidence; organizations should treat this as a confirmed vulnerability awaiting exploitation confirmation.
• The vulnerability is conditional on Publish.Auth.Enable being set to false, which determines whether anonymous readers are permitted on the publish surface.
• Port 6808 serves as the publish surface where WebSocket sessions are established and subsequently added to the shared broadcast session pool.
• Remediation requires verifying whether affected SiYuan versions have been patched and whether publish mode configurations expose the vulnerable code path.
• The vulnerability affects the SiYuan kernel component, specifically the broadcast session management logic within the WebSocket handling subsystem.
• Organizations should prioritize inventorying SiYuan deployments with publish mode enabled and authentication disabled before assessing remediation urgency.

The following facts are directly supported by the supplied source evidence and structured fields. No additional facts are asserted beyond what is explicitly documented.

• CVE-2026-72810 corresponds to a vulnerability in the SiYuan application hosted at github.com/siyuan-note/siyuan.
• The vulnerability affects the kernel component of SiYuan, specifically within the broadcast session pool management.
• WebSocket sessions established through the publish surface on port 6808 are added to the same broadcast session pool as other sessions.
• Anonymous readers with RoleReader access receive a live unfiltered feed of all edits when Publish.Auth.Enable is false.
• The unfiltered feed includes protected and forbidden documents that should not be accessible to anonymous readers.
• The vulnerability was published by CYBERDUDEBIVASH on 2026-09-03T23:02:13+00:00.
• The source URL is https://blog.cyberdudebivash.in/posts/cve-2026-72810-go-github-com-siyuan-note-siyuan-kernel.html.
• CDB_EXPLOITATION_STATUS is unknown; active exploitation is not established in cited evidence.
• CDB_KEV_LISTED is None; KEV catalog inclusion is not established in cited evidence.

This vulnerability is classified as an information disclosure vulnerability arising from improper authorization boundary enforcement within a WebSocket broadcast subsystem. The vulnerability type is a publish-boundary bypass that conflates anonymous reader sessions with authenticated broadcast sessions, resulting in unauthorized access to protected document content. The vulnerability affects the SiYuan kernel, which is the core processing component of the SiYuan note-taking application.

The threat classification is aligned with CWE-284 (Improper Access Control) and CWE-200 (Information Exposure) based on the described behavior of anonymous readers receiving content that should be restricted. The vulnerability does not involve remote code execution, privilege escalation, or denial of service based on the supplied evidence. The primary impact is confidentiality loss through unauthorized disclosure of protected and forbidden documents to anonymous readers on the publish surface.

Severity assessment is constrained by the limited evidence available. The vulnerability enables information disclosure of protected and forbidden documents to anonymous readers, which represents a significant confidentiality impact for organizations using SiYuan for sensitive knowledge management. The conditional nature of the vulnerability—requiring Publish.Auth.Enable to be false—limits the attack surface to deployments with this specific configuration. However, publish mode with disabled authentication may be a common configuration for organizations seeking to share content externally, which could increase exposure.

CVSS scoring, EPSS probability, and KEV catalog status are not established in cited evidence. Organizations should assess severity based on their specific deployment configuration, the sensitivity of documents stored in SiYuan, and whether publish mode with disabled authentication is in use. The absence of no confirmed exploitation in cited evidence evidence reduces immediate urgency but does not diminish the confirmed vulnerability's potential impact.

The primary evidence source is a CYBERDUDEBIVASH advisory published on 2026-09-03, which documents the vulnerability and provides the CVE identifier. The source is classified as a threat intelligence and vulnerability advisory publisher. The structured evidence fields confirm the CVE identifier, the affected product (SiYuan), the component (kernel), and the vulnerability mechanism (WebSocket broadcast session pool conflation).

Source confidence is assessed as MEDIUM for the vulnerability description, as the source provides specific technical details including the port number (6808), the role designation (RoleReader), and the configuration condition (Publish.Auth.Enable false). However, the source does not provide independent verification of exploitation, CVSS scoring, or vendor confirmation. The CDB pipeline fields indicate that exploitation status is unknown and KEV listing is not established, which constrains the actionable intelligence available for immediate response.

The available timeline is limited to the publication date of the advisory. The following chronology is established from the supplied evidence.

• 2026-09-03T23:02:13+00:00: CYBERDUDEBIVASH publishes the advisory documenting CVE-2026-72810 in the SiYuan kernel.
• The advisory identifies the vulnerability as a publish-boundary bypass via WebSocket broadcast session pool conflation.
• The advisory provides the CVE identifier and links to the NVD record for CVE-2026-72810.
• Active exploitation status is not established in cited evidence as of the publication date.
• Vendor response, patch availability, and mitigation guidance are not established in cited evidence.

Organizations should monitor for vendor advisories, patch releases, and exploitation reports that may update the timeline and severity assessment. The absence of a vendor response in the supplied evidence means that remediation timing and availability remain unknown.

The business impact of CVE-2026-72810 centers on unauthorized disclosure of protected and forbidden documents to anonymous readers. Organizations using SiYuan for knowledge management, documentation, or collaborative editing may expose sensitive content including internal policies, project plans, proprietary information, and restricted documents. The impact is conditional on the deployment configuration—specifically, whether publish mode is enabled with authentication disabled.

Organizations with publish mode enabled and Publish.Auth.Enable set to false face direct exposure, as anonymous readers can receive a live unfiltered feed of all edits. This includes documents that should be restricted to authorized users. The impact extends to any content created, edited, or accessed within the affected SiYuan instance, as the broadcast session pool does not filter content based on access controls. Organizations should assess the sensitivity of content stored in affected deployments and the potential regulatory, compliance, or competitive implications of unauthorized disclosure.

Enterprise exposure depends on three factors: whether SiYuan is deployed, whether publish mode is enabled, and whether Publish.Auth.Enable is set to false. Organizations should inventory their SiYuan deployments and evaluate each instance against these conditions. The vulnerability affects the kernel component, which is present in all SiYuan deployments, but the attack surface is limited to instances with the specific configuration that enables anonymous reader access.

Exposure determination requires identifying SiYuan instances with publish mode enabled on port 6808 and authentication disabled. Organizations should review their deployment configurations, network segmentation, and access controls to determine whether anonymous readers can reach the publish surface. The vulnerability does not require authentication, which means that any network path to port 6808 on an affected instance represents a potential exposure. Organizations should prioritize assessment of internet-facing SiYuan deployments and internal deployments accessible to untrusted networks.

The vulnerability arises from the SiYuan kernel's WebSocket broadcast session management logic. When publish mode is enabled with Publish.Auth.Enable set to false, anonymous readers establish WebSocket sessions through the publish surface on port 6808. These sessions are assigned the RoleReader designation and are added to the same broadcast session pool as authenticated sessions. The broadcast session pool distributes all document edits to connected sessions without filtering based on access controls or document permissions.

The technical root cause is the conflation of trust boundaries between anonymous reader sessions and authenticated sessions within the broadcast session pool. The kernel does not enforce document-level access controls when distributing broadcast updates, which means that anonymous readers receive edits to protected and forbidden documents alongside public content. The vulnerability is architectural in nature, as it stems from the session pool design rather than a specific code defect. Remediation would require separating anonymous reader sessions from the broadcast session pool or implementing access control filtering within the broadcast distribution logic.

As a CVE_VULNERABILITY_REPORT, this section provides detailed analysis of the affected product, weakness, prerequisites, attack surface, exploitability, and remediation considerations based on the supplied evidence.

Affected Product and Version: The vulnerability affects the SiYuan note-taking application, specifically the kernel component hosted at github.com/siyuan-note/siyuan. Specific affected versions are not established in cited evidence. Organizations should verify whether their deployed version is affected by checking vendor advisories and patch notes.

Weakness and Root Cause: The weakness is improper access control enforcement within the WebSocket broadcast session pool. The root cause is the architectural decision to add anonymous reader sessions to the same broadcast session pool as authenticated sessions, which eliminates the trust boundary between anonymous and authorized access. The broadcast distribution logic does not filter content based on document permissions or access controls.

Prerequisites: The vulnerability requires publish mode to be enabled with Publish.Auth.Enable set to false. This configuration allows anonymous readers to establish WebSocket sessions on port 6808. Without this configuration, the vulnerable code path is not reachable. Organizations should verify their deployment configuration to determine whether the prerequisites are met.

Reachable Attack Surface: The attack surface is limited to SiYuan instances with publish mode enabled and authentication disabled. Port 6808 serves as the publish surface where anonymous readers establish WebSocket sessions. The attack surface is reachable from any network path that allows connections to port 6808 on the affected instance. Internet-facing deployments and internal deployments accessible to untrusted networks represent the highest exposure.

Exploitability Evidence: Active exploitation is not established in cited evidence. The CDB_EXPLOITATION_STATUS field is unknown, and no exploitation reports, proof-of-concept code, or wild exploitation indicators are provided in the source. Organizations should treat this as a confirmed vulnerability awaiting exploitation confirmation.

CVSS/CWE/EPSS/KEV Status: CVSS scoring, CWE classification, EPSS probability, and KEV catalog status are not established in cited evidence. The CDB_KEV_LISTED field is None. Organizations should monitor for vendor and NVD updates that may provide scoring and catalog information.

Remediation and Mitigation: Specific remediation guidance is not established in cited evidence. Organizations should monitor for vendor patches and advisories. Immediate safe actions include disabling publish mode or enabling authentication (Publish.Auth.Enable true) if the functionality is not required. Post-fix validation should confirm that anonymous readers no longer receive unfiltered broadcast feeds and that protected documents remain inaccessible.

Exposure and Post-Fix Validation: Exposure assessment requires inventorying SiYuan deployments and verifying publish mode configuration. Post-fix validation should include testing WebSocket session behavior to confirm that anonymous readers are excluded from the broadcast session pool or that broadcast content is filtered based on access controls. Organizations should verify that protected and forbidden documents are no longer accessible to anonymous readers after remediation.

ATT&CK technique mapping is constrained by the supplied evidence. The vulnerability enables unauthorized access to protected documents through the broadcast session pool, which aligns with the following techniques based on the described behavior.

• ATT&CK Technique T1078 (Valid Accounts): Not directly applicable, as the vulnerability involves anonymous access rather than valid account misuse.
• ATT&CK Technique T1110 (Brute Force): Not applicable based on supplied evidence.
• ATT&CK Technique T1530 (Data from Cloud Storage): Not applicable, as SiYuan is not a cloud storage service.
• ATT&CK Technique T1213 (Data from Information Repositories): Potentially applicable, as the vulnerability enables access to documents stored in SiYuan, which functions as an information repository. Confidence: MEDIUM, based on the described behavior of anonymous readers receiving document edits.
• ATT&CK Technique T1005 (Data from Local System): Not directly applicable, as the vulnerability involves network-based access rather than local system access.

The primary ATT&CK alignment is with data access techniques that involve unauthorized access to information repositories. The vulnerability does not involve initial access, execution, persistence, or lateral movement based on the supplied evidence. Organizations should map the vulnerability to their specific ATT&CK coverage and detection capabilities to identify gaps in monitoring for unauthorized data access through WebSocket broadcast channels.

Indicators and observables are limited by the supplied evidence. The following indicators are derived from the vulnerability description and may be used for detection and monitoring.

• WebSocket connections to port 6808 on SiYuan instances with publish mode enabled and authentication disabled.
• Anonymous reader sessions (RoleReader) establishing WebSocket connections to the publish surface.
• Broadcast session pool activity showing anonymous readers receiving document edit updates.
• Document edit broadcasts containing protected or forbidden document content sent to anonymous reader sessions.
• Network traffic to port 6808 from untrusted or anonymous sources.

Specific IOCs such as IP addresses, domain names, file hashes, or process names are not established in cited evidence. Organizations should monitor for WebSocket connections to port 6808 and analyze broadcast session pool activity to identify unauthorized access. Detection engineering should focus on identifying anonymous reader sessions receiving content that exceeds their authorization level.

Detection engineering for CVE-2026-72810 requires monitoring WebSocket connections to port 6808 and analyzing broadcast session pool activity. The following guidance is based on the supplied evidence and may require adaptation to specific SIEM and detection platforms.

• Monitor for WebSocket connections to port 6808 on SiYuan instances and log connection metadata including source IP, timestamp, and session role.
• Identify anonymous reader sessions (RoleReader) establishing connections when Publish.Auth.Enable is false.
• Correlate broadcast session pool activity with document access controls to identify sessions receiving content beyond their authorization level.
• Alert on anonymous reader sessions receiving edits to protected or forbidden documents.
• Monitor for unusual broadcast session pool activity, such as a high volume of document edits sent to anonymous reader sessions.

TELEMETRY SPECIFICATION / WITHHELD — INSUFFICIENT EVIDENCE: The supplied evidence does not provide sufficient detail on the WebSocket message format, broadcast session pool data structures, or document permission metadata to construct production-ready detection rules. Required telemetry includes WebSocket connection logs, broadcast session pool activity logs, document permission metadata, and session role assignments. Validation requires confirming that detection logic correctly identifies anonymous reader sessions receiving unauthorized content and does not generate false positives for authorized access patterns.

Detection validation for CVE-2026-72810 requires specific telemetry that may not be available in all environments. The following telemetry sources are required for effective detection and validation.

• WebSocket connection logs from SiYuan instances, including source IP, timestamp, session role, and connection duration.
• Broadcast session pool activity logs showing document edit updates distributed to connected sessions.
• Document permission metadata indicating which documents are protected, forbidden, or public.
• Session role assignments mapping WebSocket sessions to RoleReader or authenticated roles.
• Network flow data showing connections to port 6808 from internal and external sources.

Validation requires testing detection logic against known vulnerable and non-vulnerable configurations to confirm accuracy. False positive

Report-Type Deep Dive

This CVE Vulnerability Advisory record is analyzed according to the evidence available for its family. Unsupported exploit chains, malware capabilities, breach scope, attribution, encryption, exfiltration, and regulatory consequences are intentionally not synthesized.

MITRE ATT&CK Assessment

Not established in cited evidence. ATT&CK technique mapping requires source-backed behavior. Any mappings present in the preserved analytical body are subject to the existing ReportX semantic gate; the compiler adds none of its own. The factory does not infer the missing fact from absence of evidence.

Indicators & Observables

Not established in cited evidence. Only source-derived, validated and safely defanged observables may be operationalized. The compiler does not invent domains, IP addresses, hashes, paths, process names, mutexes, or command lines. The factory does not infer the missing fact from absence of evidence.

Detection Engineering Guidance

Detection content remains evidence-conditioned. Production rules require source-backed behavior plus the telemetry needed to validate precision; otherwise the correct output is a telemetry specification rather than fabricated executable logic.

Detection Validation & Required Telemetry

• Identify the telemetry source and fields needed to observe the cited behavior before promoting detection logic.
• Replay or safely simulate only evidence-supported behavior, measure expected false positives, and retain test evidence with the rule version.
• Do not represent syntax validation as production efficacy; deployment requires environment-specific validation and accountable approval.

Threat Hunting Queries

Threat hunting should begin with exposure to the technology or service named in the cited record and then pivot only on observables or behavior established in cited evidence. Absence of a source-backed pivot is an intelligence gap, not permission to invent one.

SOC Analyst Playbook

• Validate whether the affected technology, identity, dependency, service, or victim context exists internally.
• Preserve relevant logs and timestamps before destructive containment when an internal match is found.
• Escalate from intelligence validation to incident response only when internal telemetry or independently cited evidence supports the transition.

Incident Response & Containment Decision Plan

Public threat intelligence alone does not establish an internal incident. If internal evidence confirms relevance, preserve evidence, scope affected assets and identities, contain the validated path, eradicate the supported cause, recover, and verify recurrence controls.

Remediation & Validation Plan

• Remediation state from the normalized record: Availability not established in the source record — verify vendor guidance.
• Apply vendor/CISA remediation only when that action is actually present in trusted evidence; otherwise obtain the authoritative remediation source before changing production systems.
• After change, verify asset/version state, exposure path, relevant telemetry, and rollback readiness rather than assuming the change succeeded.

Executive Decision Matrix

• No internal exposure evidence: retain as intelligence, document the negative exposure basis, and continue collection.
• Exposure confirmed but compromise unconfirmed: prioritize supported remediation and heightened telemetry while avoiding unsupported incident claims.
• Internal malicious activity confirmed: activate the organization's incident-response process using the preserved evidence and scoped telemetry.

Executive Recommendations

• Validate enterprise relevance to the technology or service named in the cited record before treating the public record as a customer-specific finding.
• Prioritize evidence-backed remediation, telemetry coverage, and verification over severity labels alone.
• Keep unresolved exploitation, attribution, breach scope, and impact statements explicitly unresolved until corroborating evidence exists.

Intelligence Gaps & Collection Requirements

• Customer-specific exposure is not established by the public source record.
• Customer-specific compromise or impact is not established unless internal telemetry is supplied.
• Any source dimension not represented in the normalized evidence graph requires additional authoritative collection before it can drive a material claim.

Analytic Confidence & Limitations

Confidence is bounded by source reliability, information credibility, corroboration state, and unresolved contradictions already computed by ReportX. Structural compilation never raises epistemic confidence.

Forecast & Outlook

No new future event is predicted by the compiler. Forecast statements, when present in the preserved analytical body, must remain tied to ReportX supporting observation claims and explicit confidence rationale.

References

• CYBERDUDEBIVASH — https://blog.cyberdudebivash.in/posts/cve-2026-72810-go-github-com-siyuan-note-siyuan-kernel.html