CVE-2026-72791

Received Received - Intake

SiYuan Information Disclosure via Unfiltered API Endpoint

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-72791

EUVD

EUVD-2026-57451

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (inc)
siyuan	siyuan	to 3.7.4 (exc)
siyuan	siyuan	From 3.7.4-alpha.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72791 is an information disclosure vulnerability in SiYuan v3.7.4-alpha.1. It affects the /api/av/getAttributeViewFieldViews endpoint, which exposes database view structures to unauthorized users. The endpoint lacks proper publish-access filtering, allowing readers to retrieve view names, icons, layout types, and field visibility settings for any database using its avID.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running version v3.7.4-alpha.1 or later. Verify if the endpoint /api/av/getAttributeViewFieldViews exists and if it returns database view structures without proper authorization checks. Use network monitoring tools to inspect HTTP requests to this endpoint.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive database structures, including unpublished view names and hidden field configurations. Attackers could exploit it to enumerate all views in a database, potentially exposing confidential information without requiring elevated privileges or user interaction.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to apply the fix. Ensure the endpoint /api/av/getAttributeViewFieldViews enforces the same authorization checks as /api/av/getAttributeViewKeys. Restrict access to sensitive databases and review user permissions to minimize exposure.

Hi! I’m here to help you understand CVE-2026-72791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70