CVE-2026-86192 in SiYuan
Summary
by MITRE • 09/05/2026
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in SiYuan prior to version 3.8.2 represents a critical failure in access control mechanisms within its data retrieval architecture. Specifically, the flaw resides in the getAttributeViewKeys endpoint, which is designed to return metadata about attribute views for database entries. In a properly secured system, this endpoint should strictly enforce document-level permissions, ensuring that users can only retrieve keys and values associated with documents they have explicit read access to. However, due to insufficient filtering logic, the application fails to validate whether the requesting user possesses the necessary privileges before returning private attribute-view cell values. This oversight allows any authenticated user, including those designated as publish readers who typically possess limited permissions, to bypass intended restrictions and extract sensitive data from documents they are not authorized to view.
From a technical perspective, this issue is classified under CWE-284 Improper Access Control, specifically reflecting a failure in enforcing object-level access controls. The vulnerability exploits the lack of server-side validation on the context of the requested resource. When an attacker queries the getAttributeViewKeys endpoint with identifiers for rows bound to inaccessible documents, the backend processes the request and returns the hidden KeyValues payloads without checking if the current session has permission to view those specific document IDs. This behavior effectively turns a metadata retrieval function into a data exfiltration vector, as it exposes internal database structures and private content that were intended to remain isolated from unauthorized parties. The absence of proper authorization checks at this layer undermines the integrity of the application's security model, allowing for information disclosure through standard API interactions rather than requiring complex exploitation techniques or privilege escalation.
The operational impact of this vulnerability is significant, particularly in collaborative environments where SiYuan is used as a knowledge base or project management tool. Publish readers often have access to public-facing content but are restricted from viewing private notes, internal strategies, or confidential user data. By exploiting this flaw, an attacker can retrieve hidden KeyValues payloads that contain sensitive information such as personal identifiers, proprietary business logic, or secure credentials stored within database cells. This unauthorized exposure violates the principle of least privilege and compromises the confidentiality of all data associated with inaccessible documents. For organizations relying on SiYuan for secure documentation management, this vulnerability poses a direct risk to data privacy compliance and intellectual property protection, potentially leading to reputational damage and regulatory penalties depending on the nature of the exposed information.
To mitigate this risk, immediate action is required by upgrading the SiYuan installation to version 3.8.2 or later, where these access control checks have been implemented in the getAttributeViewKeys endpoint. Until an upgrade can be performed, administrators should consider restricting network exposure for instances running vulnerable versions and ensuring that only trusted users are granted publish reader privileges if possible. Furthermore, implementing a Web Application Firewall with rules capable of detecting anomalous patterns in API requests targeting database endpoints may provide temporary protection by blocking unauthorized access attempts. Long-term remediation strategies should include rigorous code reviews focusing on authorization logic across all data retrieval APIs to ensure consistent enforcement of permission checks against every resource accessed via the application interface. This incident underscores the importance of validating user permissions at every layer of the request lifecycle, particularly when handling sensitive database operations that interact with restricted resources.