CVE-2026-104410 in SiYuan
Summary
by MITRE • 10/02/2026
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The SiYuan note-taking application, prior to version 3.8.5, contains a critical information disclosure vulnerability that undermines the intended access control mechanisms for published documents. This flaw specifically affects users who publish their notes with database views embedded within them. The core issue lies in the implementation of the /api/export/preview endpoint, which is designed to generate preview content for public-facing pages but fails to properly enforce authentication and authorization checks when accessing data stored in linked databases. Consequently, individuals without valid credentials can bypass restrictions intended to protect sensitive information contained within these database rows.
From a technical perspective, the vulnerability stems from an improper access control mechanism where the server processes requests for export previews of published documents containing database views without verifying whether the user has permission to view specific protected fields or entire rows marked as password-protected or publish-disabled. When an attacker constructs a request targeting this endpoint with parameters referencing a public document that includes such a database view, the backend logic retrieves and returns the primary key text along with cell values for all associated records. This behavior effectively exposes data that was explicitly configured to be hidden from unauthorized viewers, creating a direct path for information leakage through standard HTTP requests rather than requiring complex exploitation techniques or privilege escalation.
The operational impact of this vulnerability is significant for organizations and individuals relying on SiYuan for secure knowledge management. Attackers can systematically enumerate database entries by iterating through primary keys or leveraging known document structures to extract sensitive data such as personal identifiers, internal notes, financial figures, or proprietary business information stored within the database cells. Since the affected endpoint does not require authentication, the attack surface is broad and easily exploitable using automated tools. This leads to a complete compromise of confidentiality for any published content that integrates with protected databases, potentially violating regulatory compliance requirements such as GDPR or HIPAA if personal health or personally identifiable information is involved.
This vulnerability aligns closely with CWE-200: Information Exposure, where the software exposes sensitive information to an actor that is not explicitly authorized to have access to it. Furthermore, in terms of tactical classification within the MITRE ATT&CK framework, this behavior corresponds to T1530: Data from Cloud Storage Object or potentially T1005: Data from Local System depending on how the database backend is architected and accessed, as it involves exfiltrating data that was intended to be restricted. The lack of proper authorization checks during export preview generation represents a fundamental failure in implementing secure access control policies for dynamic content retrieval operations.
To mitigate this risk, users must upgrade immediately to SiYuan version 3.8.5 or later, where the developers have addressed the logic flaw within the /api/export/preview endpoint by enforcing strict authorization checks before returning database row data. Until an update is applied, administrators should consider disabling public publishing features for documents that contain sensitive databases or restricting access to these endpoints via network-level controls if possible. Additionally, implementing regular security audits and penetration testing focused on API authentication flows can help identify similar misconfigurations in other web applications where export or preview functionalities interact with protected data stores.