Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to unauthorized readers
Vulnerability ID: GHSA-9CQF-HHRQ-7V45
CVSS Score: 5.3
Published: 2026-10-01
An authorization bypass and information leakage vulnerability exists in the SiYuan database module. Unauthenticated users can query the getAttributeViewSearchTarget API endpoint using target block identifiers to extract private content.
TL;DR
Missing publish-access check on the /api/av/getAttributeViewSearchTarget endpoint in SiYuan allows unauthorized substring-based extraction of private database row contents.
Technical Details
- CWE ID: CWE-862, CWE-200
- Attack Vector: Network
- CVSS v3.1 Score: 5.3 (Medium)
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
Affected Systems
- SiYuan Knowledge Workspace Platform
-
SiYuan: < 3.8.0 (Fixed in:
3.8.0)
Code Analysis
Commit: 9b8e895
Add getAttributeViewSearchTarget endpoint
Mitigation Strategies
- Apply server-side publish-access middleware to validate block accessibility.
- Restrict API endpoint access via network ACLs or reverse proxy configuration.
- Disable public publishing features if private data is stored.
Remediation Steps:
- Upgrade SiYuan to version 3.8.0 or later where access checks are properly enforced.
- Configure reverse proxy rules to block external access to /api/av/getAttributeViewSearchTarget.
- Audit published notebooks to ensure no private database blocks are referenced.
Read the full report for GHSA-9CQF-HHRQ-7V45 on our website for more details including interactive diagrams and full exploit analysis.
