CVE-2026-86191 in SiYuan
Summary
by MITRE • 09/05/2026
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The identified security flaw resides within SiYuan, a comprehensive note-taking application, specifically affecting versions prior to v3.8.2. This vulnerability is classified as an information disclosure issue located in the getAttributeViewKeysByID endpoint. The core technical deficiency lies in the insufficient access control mechanisms governing this specific API function. While the application correctly enforces visibility checks for standard database content based on parent document permissions, it fails to apply equivalent verification logic when retrieving attribute view key definitions. This architectural oversight allows authenticated users with publish-only read privileges to bypass intended restrictions and query internal schema metadata that should remain hidden from external viewers.
From a technical perspective, the vulnerability exploits the decoupling of data retrieval and schema definition checks. When an attacker invokes the getAttributeViewKeysByID endpoint using identifiers associated with private or restricted databases, the server processes the request without validating whether the requesting user has explicit permission to view those specific database attributes. Consequently, the system returns complete key schemas, which include sensitive field names, data types, and complex relation definitions that were intended to be concealed from public-facing interfaces. This behavior effectively neutralizes the security boundary established by the parent document's visibility settings, as metadata exposure provides a detailed blueprint of the internal data structure regardless of content access restrictions.
The operational impact of this vulnerability is significant for organizations relying on SiYuan for sensitive information management. By enumerating private attribute view key definitions, attackers can map out the entire logical structure of hidden databases without needing to read actual record values. This reconnaissance phase facilitates further attacks by revealing field names that may correspond to personally identifiable information or proprietary business logic. Knowledge of relation definitions allows adversaries to understand how different data entities are interconnected, potentially aiding in social engineering efforts or targeted exploitation of other system components if related APIs share similar flaws. The exposure of schema details also aids in crafting precise injection payloads should any downstream processing be vulnerable to code execution based on input structure assumptions.
This incident aligns with CWE-200, which categorizes the improper restriction of information disclosure to unauthorized actors. It also maps closely to ATT&CK technique T1087, specifically endpoint discovery and account enumeration phases where adversaries gather system configuration data to plan subsequent intrusions steps. The failure represents a classic case of broken object level authorization where metadata access is not treated with the same rigor as content access.
To mitigate this risk, immediate upgrade to SiYuan version v3.8.2 or later is required as it addresses these permission checks. In environments where upgrading is delayed, administrators should implement network-level controls such as web application firewalls that restrict direct API access for non-administrative roles unless explicitly whitelisted. Additionally, implementing strict input validation and ensuring all database-related endpoints perform consistent visibility audits against the current user's session permissions will prevent unauthorized schema enumeration. Regular security assessments focusing on API authorization logic are recommended to identify similar discrepancies in other data retrieval functions within the application stack.