CVE-2026-86191: SiYuan before v3.8.2 Private Attribute View Key Enumeration
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Configuration
Ensure getAttributeViewKeysByID verifies the parent database visibility before returning private attribute view key definitions, to prevent publish readers from enumerating private attribute view keys.
SiYuan getAttributeViewKeysByID endpoint parent database visibility verification for private attribute view key enumeration = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
A publish reader can exploit it. The attacker needs access to the affected SiYuan endpoint but does not need administrative privileges or user interaction.
What information may be exposed?
The endpoint can disclose complete private attribute-view key schemas from hidden databases, including sensitive field names and relation definitions.
Which deployments are affected?
SiYuan versions before v3.8.2 are affected. Deployments where users have publish-reader access are exposed to this enumeration issue.
How can I determine whether sensitive data may already be exposed?
Review access to the getAttributeViewKeysByID endpoint by publish readers and identify hidden databases containing private attribute views. Key-schema retrieval for databases whose parent visibility should have prevented access is indicative of exposure.