CVE-2026-73608: SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Compensating control
Temporarily restrict network access to the /api/av/getAttributeViewSearchTarget endpoint (e.g., via firewall/ACL/WAF rules) until SiYuan is upgraded to v3.7.4, since the development branch route is registered with CheckAuth only and performs no additional authorization checks.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73608?
CVE-2026-73608 has a high severity rating of 8.6.
How do I fix CVE-2026-73608?
To fix CVE-2026-73608, upgrade to SiYuan version 3.7.4 or later where the vulnerability is patched.
What does CVE-2026-73608 affect?
CVE-2026-73608 affects the SiYuan development branch prior to version 3.7.4.
What type of vulnerability is CVE-2026-73608?
CVE-2026-73608 is an authorization bypass vulnerability in the /api/av/getAttributeViewSearchTarget endpoint.
Is there a known exploit for CVE-2026-73608?
Yes, CVE-2026-73608 can be exploited by attackers to access unauthorized data through the vulnerable endpoint.