Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 7 October 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0.0.0-20260726161145-9b8e8956f997,fixed=0.0.0-20260812083335-251596fc0de2; SiYuan Note SiYuan development branch after commit 9b8e8956f (July 27, 2026); not present in v3.7.3 or earlier.

Is there a fix for This vulnerability?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SiYuan getAttributeViewSearchTarget insufficient access control

Severity: info · Published 2026-10-07

SiYuan is a note-taking application that allows users to embed searchable databases within published pages. The getAttributeViewSearchTarget API endpoint bypasses access checks and returns database row content to unauthenticated readers, even when those rows are restricted or in hidden documents. An attacker can systematically retrieve sensitive data that the application intended to withhold from anonymous viewers.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan Note SiYuan. Vendors: Go, SiYuan Note.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 7 October 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0.0.0-20260726161145-9b8e8956f997,fixed=0.0.0-20260812083335-251596fc0de2; SiYuan Note SiYuan development branch after commit 9b8e8956f (July 27, 2026); not present in v3.7.3 or earlier.
Is there a fix for This vulnerability?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260812083335-251596fc0de2
```

Technical details

The /api/av/getAttributeViewSearchTarget endpoint in the development branch performs authentication (CheckAuth) but lacks authorization checks present in adjacent routes (CheckReadonly, CheckPublishAuthCookie). It calls GetAttributeViewSearchTarget without checking encrypted notebook status or publish access filters, directly exposing database rows to anonymous readers. The vulnerability enables a substring oracle attack over database columns and affects only the development branch; v3.7.3 and stable releases are unaffected.

Affected products

SiYuan Note SiYuan development branch after commit 9b8e8956f (July 27, 2026); not present in v3.7.3 or earlier

Identifiers

GHSA-9cqf-hhrq-7v45
GO-2026-6632

Timeline

2026-07-29: disclosed: Privately reported as pre-release issue
2026-10-07: advisory: Public advisory published as GO-2026-6632 and GHSA-9cqf-hhrq-7v45

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.