CVE-2026-86192
Received Received - Intake

SiYuan Private Attribute-View Data Exposure via getAttributeViewKeys

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86192
EUVD
EUVD-2026-72013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan versions before v3.8.2 have a flaw where the getAttributeViewKeys endpoint does not properly filter private attribute-view cell values. This allows publish readers to retrieve hidden KeyValues payloads from rows linked to inaccessible documents, exposing private database contents without authorization.

Detection Guidance

To detect this vulnerability, check SiYuan versions before 3.8.2. Use commands like 'curl -X POST http://localhost:6806/api/av/getAttributeViewKeys -H "Content-Type: application/json" -d '{"id":"test"}' to test the endpoint for exposed KeyValues. Monitor logs for unauthorized access to private data.

Impact Analysis

An attacker with reader access could exploit this to view sensitive data like text, numbers, dates, URLs, assets, relations, and rollups from private database rows without needing direct access to the hidden documents. This could lead to unauthorized data exposure or privacy breaches.

Compliance Impact

This vulnerability could result in non-compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized access to private or sensitive data. Organizations using affected SiYuan versions may face legal or regulatory penalties due to data breaches.

Mitigation Strategies

Upgrade SiYuan to version 3.8.2 or later immediately. Ensure no sensitive data is exposed by reviewing attribute-view rows linked to inaccessible documents. Apply patches and regression tests as advised in the official advisories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86192. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart