Description
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Published: 2026-08-12
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an information disclosure flaw in the /api/av/getAttributeViewFieldViews endpoint of SiYuan. The endpoint is protected by an authentication check but lacks proper publish‑access filtering, allowing users with a reader role to query any database by supplying an avID. In doing so, the response exposes the full database view structure, including names, icons, layout types, and the hidden status of each field. This breach of unauthorized access corresponds to CWE‑862.

Affected Systems

The flaw affects the pre‑release version v3.7.4‑alpha.1 of SiYuan. Versions up to and including v3.7.3 are not impacted because the endpoint does not exist in those releases. The issue was fixed in the first stable release of v3.7.4.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can authenticate as a reader can easily invoke the endpoint, implying a low exploitation barrier for authenticated users. The primary risk is the disclosure of database view metadata, which could aid further attacks but does not allow direct manipulation of data or code.

Generated by OpenCVE AI on August 12, 2026 at 23:06 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SiYuan to version 3.7.4 or later where the endpoint is correctly filtered.
  • Restrict access to the /api/av/getAttributeViewFieldViews endpoint by ensuring only privileged roles can call it or by blocking the route for reader‑role users through firewall or reverse‑proxy rules.
  • Implement an audit or review process to confirm that no other exposure of database metadata exists in the application.

Generated by OpenCVE AI on August 12, 2026 at 23:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 12 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Title SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-12T20:55:15.173Z

Reserved: 2026-08-10T15:10:15.963Z

Link: CVE-2026-72791

cve-icon Vulnrichment

Updated: 2026-08-12T20:46:11.327Z

cve-icon NVD

Status : Received

Published: 2026-08-12T20:17:50.550

Modified: 2026-08-12T21:17:39.947

Link: CVE-2026-72791

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-12T23:15:03Z

Weaknesses