Executive brief
SiYuan is a note-taking application that supports embedded databases with multiple views. An unpatched API endpoint fails to restrict access based on publish permissions, allowing anonymous readers or readers with limited access to view the complete structure of unpublished database views—including view names, layout types, and field visibility settings that the author intended to keep private.
Technical details
The `/api/av/getAttributeViewFieldViews` endpoint in SiYuan's kernel is missing publish-access filtering. The endpoint is registered with only basic authentication (`CheckAuth`) and no role-based gating, whereas its sibling endpoint `getAttributeViewKeys` properly applies `IsReadOnlyRoleContext` and `FilterBlockAttributeViewKeysByPublishAccess` checks. An attacker who can obtain valid `avID` and `keyID` parameters (available from any reader-accessible database embedded in a published document) can call this endpoint to enumerate all views, including unpublished ones, and retrieve metadata: view ID, icon, name, type, and the per-field `Hidden` flag. This discloses the author's data-organization intent without authorization. The vulnerability requires network reachability but no authentication in anonymous publish mode; the endpoint directly reads storage files by identifier with no ownership or visibility checks.
Affected products
- SiYuan SiYuan < 0.0.0-20260726004013-64c26e74bb82 (v3.7.4-alpha.1, dev branch only; no released stable version affected)
Timeline
- 2026-07-26: disclosed: Endpoint live on v3.7.4-alpha.1 dev branch
- 2026-07-26: patched: Fixed in commit 64c26e74bb82
References
- https://api.github.com/users/shirshakopencti
- https://github.com/shirshakopencti
- https://api.github.com/users/shirshakopencti/gists%7B/gist_id%7D
- https://api.github.com/users/shirshakopencti/repos
- https://avatars.githubusercontent.com/u/210834347?v=4
- https://api.github.com/users/shirshakopencti/events%7B/privacy%7D