Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.8, published 8 September 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260726004013-64c26e74bb82; SiYuan < 0.0.0-20260726004013-64c26e74bb82 (v3.7.4-alpha.1, dev branch only; no released stable version affected).

Is there a fix for This vulnerability?

A patch was published on 2026-07-26: Fixed in commit 64c26e74bb82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SiYuan getAttributeViewFieldViews missing authorization

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-26: Fixed in commit 64c26e74bb82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.8 · Published 2026-09-08

SiYuan is a note-taking application that supports embedded databases with multiple views. An unpatched API endpoint fails to restrict access based on publish permissions, allowing anonymous readers or readers with limited access to view the complete structure of unpublished database views—including view names, layout types, and field visibility settings that the author intended to keep private.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.8, published 8 September 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260726004013-64c26e74bb82; SiYuan < 0.0.0-20260726004013-64c26e74bb82 (v3.7.4-alpha.1, dev branch only; no released stable version affected).
Is there a fix for This vulnerability?: A patch was published on 2026-07-26: Fixed in commit 64c26e74bb82 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The `/api/av/getAttributeViewFieldViews` endpoint in SiYuan's kernel is missing publish-access filtering. The endpoint is registered with only basic authentication (`CheckAuth`) and no role-based gating, whereas its sibling endpoint `getAttributeViewKeys` properly applies `IsReadOnlyRoleContext` and `FilterBlockAttributeViewKeysByPublishAccess` checks. An attacker who can obtain valid `avID` and `keyID` parameters (available from any reader-accessible database embedded in a published document) can call this endpoint to enumerate all views, including unpublished ones, and retrieve metadata: view ID, icon, name, type, and the per-field `Hidden` flag. This discloses the author's data-organization intent without authorization. The vulnerability requires network reachability but no authentication in anonymous publish mode; the endpoint directly reads storage files by identifier with no ownership or visibility checks.

Affected products

SiYuan SiYuan < 0.0.0-20260726004013-64c26e74bb82 (v3.7.4-alpha.1, dev branch only; no released stable version affected)

Timeline

2026-07-26: disclosed: Endpoint live on v3.7.4-alpha.1 dev branch
2026-07-26: patched: Fixed in commit 64c26e74bb82

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.