Executive brief
SiYuan is a note-taking and knowledge base application that organizes content using databases with attribute views. A flaw in the getAttributeViewKeys endpoint allows readers with limited access to retrieve hidden cell values from private database rows, exposing sensitive information that should remain restricted. This breaks the application's access control boundaries and allows unauthorized information disclosure.
Technical details
The vulnerability is an authorization bypass in the FilterBlockAttributeViewKeysByPublishAccess function (kernel/model/publish_access.go:1066-1088). While the filter correctly blocks access to rows bound to inaccessible documents by filtering BlockIDs and clearing ItemPositions, it fails to sanitize the KeyValues payload, allowing private cell values (text, numbers, dates, URLs, assets, relations, rollups) to remain in the response. The POST /api/av/getAttributeViewKeys endpoint is reachable by readers without authentication (network-accessible, PR:L). A reader can exploit this to retrieve private database contents from hidden documents. The vulnerability is fixed in v3.8.2; earlier versions are affected and should be patched immediately.
Affected products
- SiYuan SiYuan before v3.8.2
Timeline
- 2026-08-21: disclosed
- 2026-09-05: advisory
- 2026: patched: patch available in v3.8.2