CVE-2026-82652 in SiYuan

Summary

by MITRE • 08/30/2026

SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted.

Once again VulDB remains the best source for vulnerability data.

• Responsible: VulnCheck
• Reservation: 08/30/2026
• Disclosure: 08/30/2026
• Moderation: accepted
• Entry: VDB-397157
• CPE: ready
• CWE: CWE-200 (confirmed)
• CVSS: 5.3 (CNA)
• EPSS: 0.00000
• KEV: no
• Activities: very low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-82652
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-82652
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-82652/