Description
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.
Published: 2026-08-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

In the pre‑release version v3.7.4‑alpha.1 of SiYuan, the /api/av/getAttributeViewFieldViews endpoint – absent from the stable v3.7.3 and earlier releases – is protected only by CheckAuth and lacks proper publish‑access filtering. This allows reader‑role users to query any database by providing an avID, resulting in disclosure of the full database view structure, including each view's name, icon, layout type, and per‑field hidden status. The flaw is an example of unauthorized access, corresponding to CWE‑862.

Affected Systems

The flaw affects the pre‑release version v3.7.4‑alpha.1 of SiYuan. Versions up to and including v3.7.3 are not impacted because the endpoint does not exist in those releases. The issue was fixed in the first stable release of v3.7.4.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can authenticate as a reader can easily invoke the endpoint, implying a low exploitation barrier for authenticated users. The primary risk is the disclosure of database view metadata, which could aid further attacks but does not allow direct manipulation of data or code.

Generated by OpenCVE AI on October 29, 2026 at 23:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SiYuan to version 3.7.4 or later where the endpoint is correctly filtered.
  • Restrict access to the /api/av/getAttributeViewFieldViews endpoint by ensuring only privileged roles can call it or by blocking the route for reader‑role users through firewall or reverse‑proxy rules.
  • Implement an audit or review process to confirm that no other exposure of database metadata exists in the application.

Generated by OpenCVE AI on October 29, 2026 at 23:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Description SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4. SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.
Title SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared B3log
B3log siyuan
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan

Thu, 13 Aug 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Vendors & Products Siyuan
Siyuan siyuan

Wed, 12 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.
Title SiYuan before v3.7.4 Information Disclosure via getAttributeViewFieldViews
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}

Subscriptions

B3log Siyuan
Siyuan Siyuan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-29T21:16:47.876Z

Reserved: 2026-08-10T15:10:15.963Z

Link: CVE-2026-72791

cve-icon Vulnrichment

Updated: 2026-08-12T20:46:11.327Z

cve-icon NVD

Status : Deferred

Published: 2026-08-12T20:17:50.550

Modified: 2026-10-29T21:17:31.977

Link: CVE-2026-72791

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T23:15:05Z

Weaknesses