CVE-2026-101092 in SiYuan
Summary
by MITRE • 09/29/2026
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified in SiYuan versions prior to 3.8.4 represents a critical failure in access control mechanisms within the application's content management system, specifically affecting the getCurrentAttrViewImages endpoint. This flaw allows individuals with publish-read-only permissions to bypass intended restrictions and retrieve sensitive image asset paths from databases that they should not have access to. The core technical issue stems from an insufficient check of database-level authorization when processing requests for attribute view images. While the application correctly enforces these checks during standard rendering operations, it fails to validate whether the requesting user possesses valid read permissions for the specific database associated with the image assets being requested. This discrepancy creates a security gap where authentication and authorization logic is inconsistently applied across different API endpoints within the same functional module.
Attackers can exploit this vulnerability by first obtaining an unrendered database identifier through related, less restricted endpoints that do not enforce strict access controls or are accessible to public users. Once such an identifier is acquired, it can be directly injected into the getCurrentAttrViewImages endpoint. Because this specific endpoint does not adequately verify if the current session has permission to view data within that particular database, it proceeds to fetch and return the underlying file paths for images associated with detached rows in those unauthorized databases. This behavior effectively leaks internal storage structures, including full directory paths and filenames of image assets that are logically separated from public content but physically stored alongside accessible resources.
The operational impact of this vulnerability extends beyond simple data leakage. By exposing these asset paths, attackers gain insight into the server's file system structure and potentially identify other sensitive files or configurations if path traversal techniques are combined with further exploitation attempts. Although the primary outcome is information disclosure rather than direct remote code execution, the exposure of internal architecture details can facilitate more advanced attacks such as local file inclusion or targeted phishing campaigns using stolen media assets. Furthermore, this breach violates the principle of least privilege by granting users access to resources outside their designated scope, undermining the integrity and confidentiality guarantees provided by SiYuan's permission model.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves unauthorized retrieval of information due to flawed authorization checks. It also relates to CWE-601 URL Redirection to Untrusted Site or Resource if the leaked paths lead to external services, though primarily it is an access control bypass. In terms of MITRE ATT&CK framework tactics, this falls under Discovery and Collection phases, specifically leveraging API endpoints for unauthorized data acquisition without direct interaction with protected interfaces.
To mitigate this risk, users must upgrade SiYuan to version 3.8.4 or later where the issue has been resolved by enforcing consistent access control checks across all relevant endpoints. Administrators should also review their deployment configurations to ensure that no other similar inconsistencies exist in custom plugins or extended modules. Implementing strict input validation and ensuring that every API call verifies both user authentication and resource-level authorization before processing requests is essential for preventing such bypasses. Regular security audits focusing on endpoint-specific permission logic can help identify and remediate similar vulnerabilities in complex web applications.