CVE-2026-86191
Received Received - Intake

SiYuan Information Disclosure via Attribute View Key Enumeration

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86191
EUVD
EUVD-2026-72012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-86191 is an information disclosure vulnerability in SiYuan versions before v3.8.2. It allows publish readers to access the getAttributeViewKeysByID endpoint and enumerate private attribute view key definitions without verifying if the parent database is hidden. This exposes sensitive field names and relation definitions from databases that should remain private.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to the getAttributeViewKeysByID endpoint in SiYuan versions before v3.8.2. Check server logs for repeated requests to this endpoint by non-admin users. Use tools like curl to test the endpoint manually: curl -X GET 'http://<siYuan-server>/api/av/getAttributeViewKeysByID?id=<target-id>' and verify if private key definitions are exposed without proper authorization.

Impact Analysis

Attackers with publish reader privileges could retrieve complete key schemas, including confidential field names and relations, from hidden databases. This could lead to unauthorized access to sensitive data schemas, potentially aiding further attacks or data breaches.

Mitigation Strategies

Immediately upgrade SiYuan to version v3.8.2 or later to patch the vulnerability. If upgrading is not possible, restrict access to the getAttributeViewKeysByID endpoint by implementing proper authorization checks in kernel/api/av.go and kernel/model/attribute_view.go. Ensure publish-mode readers cannot access hidden database schemas by enforcing parent database visibility verification before returning key definitions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart