CVE-2026-72791 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability exists within SiYuan version 3.7.4-alpha.1 where the /api/av/getAttributeViewFieldViews endpoint fails to properly enforce access controls despite being registered with CheckAuth middleware. This represents a critical information disclosure flaw that allows unauthorized users with reader privileges to extract complete database view structures including view names, icons, layout types, and per-field hidden flags for any database identified by a supplied avID parameter. The vulnerability was introduced in commit acfc02ee8 and subsequently addressed in the stable v3.7.4 release, indicating that this issue affects only the pre-release version and not the previous stable releases.
The technical flaw stems from insufficient authorization checks within the endpoint implementation where the CheckAuth middleware is present but does not adequately filter access to publish-level data. This creates a privilege escalation scenario where users assigned reader roles can bypass normal access restrictions to obtain comprehensive metadata about database views that should typically be restricted to users with higher privileges or publisher roles. The exposure of view names, icons, layout types, and hidden field flags provides attackers with detailed insights into the database structure and potentially reveals sensitive organizational information about data organization patterns.
From an operational perspective, this vulnerability enables attackers to gather extensive intelligence about the underlying database architecture without requiring elevated privileges. The disclosure includes metadata that could be leveraged for further attacks including targeted exploitation of specific view structures, understanding data relationships, or planning more sophisticated intrusion techniques. The fact that this affects any database identified by a valid avID parameter means that an attacker with minimal access could potentially enumerate and map multiple databases within the system.
The vulnerability aligns with CWE-200 (Information Disclosure) and represents a clear violation of the principle of least privilege as defined in cybersecurity best practices. It also maps to ATT&CK technique T1213.002 (Data from Information Repositories) where adversaries collect information about data repositories and their structures. The issue demonstrates poor access control implementation where authentication is present but authorization filtering is incomplete, allowing unauthorized information gathering that could lead to more serious security breaches.
The remediation involves implementing proper publish-access filtering within the CheckAuth middleware for this specific endpoint, ensuring that reader-role users cannot access database view metadata that should be restricted to authorized publisher or administrator roles. Organizations using SiYuan should immediately upgrade to version 3.7.4 or later where this vulnerability has been addressed, and conduct thorough access control reviews to ensure similar issues do not exist in other endpoints within the system. Additionally, implementing comprehensive logging of access attempts to sensitive metadata endpoints can help detect potential exploitation attempts and provide forensic evidence for security investigations.