Executive brief
SiYuan is a personal knowledge management and note-taking application. A vulnerability in versions before 3.8.2 allows users with read access to retrieve private attribute view definitions (database field names and schema details) from hidden databases without proper authorization, exposing sensitive metadata intended to be private.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the getAttributeViewKeysByID endpoint. The API endpoint in kernel/api/av.go calls model.GetAttributeViewKeysByID directly without verifying whether the parent database is visible in publish mode or checking for publish-access permissions. The vulnerable function in kernel/model/attribute_view.go parses attribute-view files and returns complete key schemas without applying visibility checks, allowing publish readers to enumerate private field names and relation definitions. The issue affects network-reachable endpoints requiring only low-privilege reader access with no user interaction needed. A proof-of-concept test demonstrates a reader receiving private attribute-view field definitions from hidden databases. Patches are available in version 3.8.2.
Affected products
- SiYuan SiYuan before 3.8.2
Timeline
- 2026-08-21: disclosed
- 2026-09-05: advisory
- 2026-08-21: patched: Fixed in version 3.8.2