CVE-2026-72791: SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.7.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72791?
CVE-2026-72791 has a medium severity score of 5.8.
How does CVE-2026-72791 impact SiYuan users?
CVE-2026-72791 allows for information disclosure via the /api/av/getAttributeViewFieldViews endpoint, potentially exposing sensitive data.
How can I mitigate the effects of CVE-2026-72791?
To mitigate CVE-2026-72791, ensure that you are using SiYuan version 3.7.4 or later, as earlier versions are affected.
Is there a patch available for CVE-2026-72791?
A fix for CVE-2026-72791 is included in the stable release of SiYuan v3.7.4.
What is the nature of the vulnerability in CVE-2026-72791?
CVE-2026-72791 is an information disclosure vulnerability due to a lack of proper access controls on a specific API endpoint.