# SiYuan database view metadata disclosure via API endpoint

Source: https://junglewise.ai/threats/go-2026-6430-siyuan-database-view-structure-all-view-names-layout-types-ffc5d2e2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-09-10

SiYuan is a personal knowledge management and note-taking application. An API endpoint in the application incorrectly exposes the complete structure of databases (view names, types, and field visibility settings) to unauthenticated or minimally-privileged readers, even when those views were not intended to be published. This allows attackers to discover sensitive database organization and structure that should remain private.

Technologies: [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel), [SiYuan Note SiYuan](https://junglewise.ai/threats/technologies/siyuan-note-siyuan). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SiYuan Note](https://junglewise.ai/threats/vendors/siyuan-note).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 10 September 2026.

**Which products and versions are affected?** github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260726004013-64c26e74bb82; SiYuan Note SiYuan v3.7.4-alpha.1.

**Is there a fix for This vulnerability?** Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260726004013-64c26e74bb82 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a hosted service.

**Am I affected?** Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260726004013-64c26e74bb82 or later

  ```sh
  go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260726004013-64c26e74bb82
  ```


## Technical details

The /api/av/getAttributeViewFieldViews endpoint in the kernel applies only CheckAuth middleware without publish-access filtering, allowing unauthenticated readers to enumerate all views within a database by providing valid avID and keyID identifiers obtained from a partially-published database. The endpoint returns view IDs, names, icons, layout types, and per-field Hidden flags for every view regardless of publication status. The vulnerability exists because the handler lacks FilterBlockAttributeViewKeysByPublishAccess checks that sibling endpoints apply, a pattern which had been repeated in prior security issues during the same development cycle.

## Affected products

- SiYuan-Note SiYuan v3.7.4-alpha.1

## Timeline

- 2026-07-26: disclosed
- 2026-07-26: patched: Fixed in v3.7.4

## References

- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4)
- [https://github.com/siyuan-note/siyuan/commit/64c26e74bb82c24a73513107684b91cc01335fab](https://github.com/siyuan-note/siyuan/commit/64c26e74bb82c24a73513107684b91cc01335fab)

## Related threats

- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path-traversal bypass via Windows extended-length prefix](https://junglewise.ai/threats/cve-2026-116171-siyuan-3-5-4-before-3-8-7-on-windows-contains-a-sensitive-path)
- [SiYuan stored cross-site scripting in KaTeX math blocks](https://junglewise.ai/threats/cve-2026-116169-siyuan-from-2-10-0-before-3-8-7-contains-a-stored-cross-site)
- [SiYuan path traversal in MCP asset tool via incomplete blacklist](https://junglewise.ai/threats/cve-2026-116168-siyuan-before-3-8-7-contains-a-path-traversal-vulnerability-in)
- [SiYuan WebSocket parser differential allows unauthenticated event stream access](https://junglewise.ai/threats/cve-2026-73054-siyuan-a-parser-differential-between-the-websocket-keepalive)