CVE-2026-72791

Deferred Deferred - Pending Action

SiYuan Information Disclosure via Unfiltered API Endpoint

Publication date: 2026-08-12

Last updated on: 2026-10-29

Assigner: VulnCheck

Description

SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-08-13

EPSS Evaluated

2026-11-07

NVD

CVE-2026-72791

EUVD

EUVD-2026-57451

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (inc)
siyuan	siyuan	to 3.7.4 (exc)
siyuan	siyuan	From 3.7.4-alpha.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72791 is an information disclosure vulnerability in SiYuan v3.7.4-alpha.1. It affects the /api/av/getAttributeViewFieldViews endpoint, which exposes database view structures to unauthorized users. The endpoint lacks proper publish-access filtering, allowing readers to retrieve view names, icons, layout types, and field visibility settings for any database using its avID.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running version v3.7.4-alpha.1 or later. Verify if the endpoint /api/av/getAttributeViewFieldViews exists and if it returns database view structures without proper authorization checks. Use network monitoring tools to inspect HTTP requests to this endpoint.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive database structures, including unpublished view names and hidden field configurations. Attackers could exploit it to enumerate all views in a database, potentially exposing confidential information without requiring elevated privileges or user interaction.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive database view structures. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Exposure of view names, layouts, and field visibility flags may violate confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to apply the fix. Ensure the endpoint /api/av/getAttributeViewFieldViews enforces the same authorization checks as /api/av/getAttributeViewKeys. Restrict access to sensitive databases and review user permissions to minimize exposure.

Hi! I’m here to help you understand CVE-2026-72791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...