SiYuan’s development‑branch code introduces an authorization bypass flaw in the /api/av/getAttributeViewSearchTarget endpoint. The endpoint is protected only by a generic authentication check and performs no further verification of publish‑access or encrypted‑notebook permissions. As a result, an unauthenticated user can send a database identifier that was extracted from a publicly published page together with a keyword, and the endpoint will return rows that should normally be hidden by publish filters. This can lead to the disclosure of sensitive data that was intended to remain private. The weakness is classified as CWE‑862, an Authorization Bypass vulnerability, and the CVSS score of 9.2 signals a high‑severity risk.

The flaw exists exclusively in a development branch that includes commit 9b8e8956f. That branch is absent in stable releases such as v3.7.3 and the current master, and the patch is included in v3.7.4. Therefore only environments that have deployed the unpatched development code—particularly those that expose the branch in production—are affected; all released stable versions are safe.

The CVSS score of 9.2 reflects the potential for large‑scale data leakage, and the vulnerability can be exercised simply by sending a GET request to the exposed endpoint over the network. No authentication is required, only a database identifier visible on a published page and a chosen keyword. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Given the high severity and the lack of hardening on a publicly reachable instance, the risk is considered high for any environment that could allow remote unauthenticated access to the development branch.