Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to unauthorized readers

Vulnerability ID: GHSA-9CQF-HHRQ-7V45

CVSS Score: 5.3

Published: 2026-10-01

An authorization bypass and information leakage vulnerability exists in the SiYuan database module. Unauthenticated users can query the getAttributeViewSearchTarget API endpoint using target block identifiers to extract private content.

TL;DR

Missing publish-access check on the /api/av/getAttributeViewSearchTarget endpoint in SiYuan allows unauthorized substring-based extraction of private database row contents.

Technical Details

CWE ID : CWE-862, CWE-200

Attack Vector : Network

CVSS v3.1 Score : 5.3 (Medium)

Exploit Status : Proof-of-Concept

KEV Status : Not Listed

Affected Systems

SiYuan Knowledge Workspace Platform

SiYuan : < 3.8.0 (Fixed in: 3.8.0 )

Code Analysis

Commit: 9b8e895

Add getAttributeViewSearchTarget endpoint

Mitigation Strategies

Apply server-side publish-access middleware to…