CVE-2026-104410
Deferred Deferred - Pending Action

Information Disclosure in SiYuan Prior to 3.8.5

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulnCheck

Description
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104410
EUVD
EUVD-2026-91421

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
siyuan siyuan to 3.8.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SiYuan before version 3.8.5 has an information disclosure vulnerability in its /api/export/preview endpoint. Publish readers can access password-protected or publish-disabled database rows through this endpoint. The issue occurs because the export functionality does not enforce publish-access restrictions, unlike the render path which properly filters such rows.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version prior to 3.8.5. Use the endpoint /api/export/preview to test if protected database rows are accessible. Send a GET request to this endpoint with a public document containing a database view and verify if password-protected or publish-disabled rows are returned.

Impact Analysis

Attackers with publish-reader access can exploit this to retrieve sensitive data from protected documents embedded in a published database view. They can obtain primary-key text and cell values, including text, URLs, and asset paths. This could lead to unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to significant confidentiality breaches, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected SiYuan versions may face compliance violations and legal consequences due to unauthorized data exposure.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.8.5 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/export/preview endpoint by implementing proper authentication and authorization checks. Ensure publish-reader access is properly controlled and does not allow anonymous access if Basic Auth is disabled.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart