CVE-2026-73608
Received Received - Intake

SiYuan Development Branch Missing Authorization in API Endpoint

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73608
EUVD
EUVD-2026-57812

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.7.3|start_including=3.7.4 (exc)
siyuan siyuan to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73608 is a missing-authorization vulnerability in SiYuan's development branch affecting the /api/av/getAttributeViewSearchTarget endpoint. This endpoint was introduced in a commit not present in stable versions and lacks proper authorization checks beyond basic authentication. It allows anonymous users to query database rows using a database identifier and keyword, retrieving content that should be restricted by publish-access or encrypted-notebook filters.

Detection Guidance

Check if your SiYuan instance is running a development branch version before 3.7.4. Inspect network traffic for requests to the /api/av/getAttributeViewSearchTarget endpoint with a database identifier and keyword. Verify if unauthorized data retrieval occurs by monitoring responses containing database row content.

Impact Analysis

If you use SiYuan's development branch before version 3.7.4, an attacker could exploit this to access restricted database rows without authentication. This includes hidden, password-protected, or forbidden documents, as well as rows in unlocked encrypted notebooks. The attacker only needs a database block identifier from a published page, which is publicly visible.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. Unauthorized exposure of personal or health data may result in regulatory penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later. If using a development branch, ensure the /api/av/getAttributeViewSearchTarget endpoint includes proper authorization checks like CheckReadonly. Block or monitor access to the vulnerable endpoint until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart