Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to unauthorized readers

Vulnerability ID: GHSA-9CQF-HHRQ-7V45
CVSS Score: 5.3
Published: 2026-10-01

An authorization bypass and information leakage vulnerability exists in the SiYuan database module. Unauthenticated users can query the getAttributeViewSearchTarget API endpoint using target block identifiers to extract private content.

TL;DR

Missing publish-access check on the /api/av/getAttributeViewSearchTarget endpoint in SiYuan allows unauthorized substring-based extraction of private database row contents.

Technical Details

• CWE ID: CWE-862, CWE-200
• Attack Vector: Network
• CVSS v3.1 Score: 5.3 (Medium)
• Exploit Status: Proof-of-Concept
• KEV Status: Not Listed

Affected Systems

• SiYuan Knowledge Workspace Platform
• SiYuan: < 3.8.0 (Fixed in: 3.8.0)

Code Analysis

Commit: 9b8e895

Add getAttributeViewSearchTarget endpoint

Mitigation Strategies

• Apply server-side publish-access middleware to validate block accessibility.
• Restrict API endpoint access via network ACLs or reverse proxy configuration.
• Disable public publishing features if private data is stored.

Remediation Steps:

1. Upgrade SiYuan to version 3.8.0 or later where access checks are properly enforced.
2. Configure reverse proxy rules to block external access to /api/av/getAttributeViewSearchTarget.
3. Audit published notebooks to ensure no private database blocks are referenced.

Read the full report for GHSA-9CQF-HHRQ-7V45 on our website for more details including interactive diagrams and full exploit analysis.