CVE-2026-86192: SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in v3.8.2 - Compensating control
If upgrading to SiYuan v3.8.2 is not immediately possible, restrict network/API access to the getAttributeViewKeys endpoint so unauthenticated or unauthorized users cannot retrieve attribute-view KeyValues.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with publish-reader access can exploit the affected endpoint. The issue does not require user interaction, but it does require low-level privileges.
What data can be exposed?
Hidden KeyValues payloads associated with attribute-view rows bound to documents the reader cannot access may be returned. This can disclose private database contents.
Which deployments are affected?
SiYuan versions before v3.8.2 are affected. Deployments that grant publish-reader access and use attribute views containing rows linked to inaccessible documents are exposed.
How can I determine whether exposure is possible?
Review whether publish readers can call the getAttributeViewKeys endpoint and whether attribute-view rows reference documents those readers are not permitted to view. If both conditions exist on a version before v3.8.2, private cell values may be accessible.