Executive brief
SiYuan is a personal knowledge management and note-taking application. An API endpoint in the application incorrectly exposes the complete structure of databases (view names, types, and field visibility settings) to unauthenticated or minimally-privileged readers, even when those views were not intended to be published. This allows attackers to discover sensitive database organization and structure that should remain private.
Technical details
The /api/av/getAttributeViewFieldViews endpoint in the kernel applies only CheckAuth middleware without publish-access filtering, allowing unauthenticated readers to enumerate all views within a database by providing valid avID and keyID identifiers obtained from a partially-published database. The endpoint returns view IDs, names, icons, layout types, and per-field Hidden flags for every view regardless of publication status. The vulnerability exists because the handler lacks FilterBlockAttributeViewKeysByPublishAccess checks that sibling endpoints apply, a pattern which had been repeated in prior security issues during the same development cycle.
Affected products
- SiYuan-Note SiYuan v3.7.4-alpha.1
Timeline
- 2026-07-26: disclosed
- 2026-07-26: patched: Fixed in v3.7.4