# SiYuan getAttributeViewSearchTarget insufficient access control

Source: https://junglewise.ai/threats/go-2026-6632-siyuan-getattributeviewsearchtarget-returns-database-row-fd3e0f1a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-07. Updated: 2026-10-09  
License: CC BY 4.0 with a link back

Severity: info · Published 2026-10-07

SiYuan is a note-taking application that allows users to embed searchable databases within published pages. The getAttributeViewSearchTarget API endpoint bypasses access checks and returns database row content to unauthenticated readers, even when those rows are restricted or in hidden documents. An attacker can systematically retrieve sensitive data that the application intended to withhold from anonymous viewers.

Technologies: [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel), [SiYuan Note SiYuan](https://junglewise.ai/threats/technologies/siyuan-note-siyuan). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SiYuan Note](https://junglewise.ai/threats/vendors/siyuan-note).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 7 October 2026.

**Which products and versions are affected?** github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0.0.0-20260726161145-9b8e8956f997,fixed=0.0.0-20260812083335-251596fc0de2; SiYuan Note SiYuan development branch after commit 9b8e8956f (July 27, 2026); not present in v3.7.3 or earlier.

**Is there a fix for This vulnerability?** Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan Note SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260812083335-251596fc0de2 or later

  ```sh
  go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260812083335-251596fc0de2
  ```


## Technical details

The /api/av/getAttributeViewSearchTarget endpoint in the development branch performs authentication (CheckAuth) but lacks authorization checks present in adjacent routes (CheckReadonly, CheckPublishAuthCookie). It calls GetAttributeViewSearchTarget without checking encrypted notebook status or publish access filters, directly exposing database rows to anonymous readers. The vulnerability enables a substring oracle attack over database columns and affects only the development branch; v3.7.3 and stable releases are unaffected.

## Affected products

- SiYuan Note SiYuan development branch after commit 9b8e8956f (July 27, 2026); not present in v3.7.3 or earlier

## Identifiers

- GHSA-9cqf-hhrq-7v45
- GO-2026-6632

## Timeline

- 2026-07-29: disclosed: Privately reported as pre-release issue
- 2026-10-07: advisory: Public advisory published as GO-2026-6632 and GHSA-9cqf-hhrq-7v45

## References

- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45)
- [https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4](https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4)

## Related threats

- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path-traversal bypass via Windows extended-length prefix](https://junglewise.ai/threats/cve-2026-116171-siyuan-3-5-4-before-3-8-7-on-windows-contains-a-sensitive-path)
- [SiYuan stored cross-site scripting in KaTeX math blocks](https://junglewise.ai/threats/cve-2026-116169-siyuan-from-2-10-0-before-3-8-7-contains-a-stored-cross-site)
- [SiYuan path traversal in MCP asset tool via incomplete blacklist](https://junglewise.ai/threats/cve-2026-116168-siyuan-before-3-8-7-contains-a-path-traversal-vulnerability-in)
- [SiYuan WebSocket parser differential allows unauthenticated event stream access](https://junglewise.ai/threats/cve-2026-73054-siyuan-a-parser-differential-between-the-websocket-keepalive)