Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 10 September 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260726004013-64c26e74bb82; SiYuan Note SiYuan v3.7.4-alpha.1.

Is there a fix for This vulnerability?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260726004013-64c26e74bb82 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a hosted service.

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SiYuan database view metadata disclosure via API endpoint

Severity: info · Published 2026-09-10

SiYuan is a personal knowledge management and note-taking application. An API endpoint in the application incorrectly exposes the complete structure of databases (view names, types, and field visibility settings) to unauthenticated or minimally-privileged readers, even when those views were not intended to be published. This allows attackers to discover sensitive database organization and structure that should remain private.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan Note SiYuan. Vendors: Go, SiYuan Note.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 10 September 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260726004013-64c26e74bb82; SiYuan Note SiYuan v3.7.4-alpha.1.
Is there a fix for This vulnerability?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260726004013-64c26e74bb82 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a hosted service.
Am I affected?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260726004013-64c26e74bb82 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260726004013-64c26e74bb82
```

Technical details

The /api/av/getAttributeViewFieldViews endpoint in the kernel applies only CheckAuth middleware without publish-access filtering, allowing unauthenticated readers to enumerate all views within a database by providing valid avID and keyID identifiers obtained from a partially-published database. The endpoint returns view IDs, names, icons, layout types, and per-field Hidden flags for every view regardless of publication status. The vulnerability exists because the handler lacks FilterBlockAttributeViewKeysByPublishAccess checks that sibling endpoints apply, a pattern which had been repeated in prior security issues during the same development cycle.

Affected products

SiYuan-Note SiYuan v3.7.4-alpha.1

Timeline

2026-07-26: disclosed
2026-07-26: patched: Fixed in v3.7.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.