Description
SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Published: 2026-09-03
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability causes SiYuan to log API tokens that are passed as query parameters into a plaintext log file when a full-text search request exceeds certain timing thresholds. An attacker who has authenticated access to the system can then read this log file through the getFile endpoint and obtain admin API tokens, which allows them to achieve permanent administrative privileges. This flaw is a classic example of insecure logging (CWE‑532).

Affected Systems

SiYuan (siyuan-note:siyuan) versions earlier than 3.8.2 are affected.

Risk and Exploitability

The CVSS score is 8.7, indicating high severity, while no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attacks require the attacker to be authenticated to the application and able to trigger a full‑text search that exceeds the timing threshold, after which the attacker reads the log via the getFile API. If the log file is exposed, the extraction of API tokens is straightforward and grants continuous administrative access.

Generated by OpenCVE AI on September 3, 2026 at 12:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to SiYuan version 3.8.2 or later, which removes the logging of API tokens.
  • Restrict access to the application’s log files so that unauthenticated or non‑privileged users cannot read them via the getFile endpoint.
  • Implement secure logging practices by ensuring that sensitive data such as API tokens is never written to disk in plaintext (addressing CWE‑532).

Generated by OpenCVE AI on September 3, 2026 at 12:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Siyuan
Siyuan siyuan
Vendors & Products Siyuan
Siyuan siyuan

Thu, 03 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.
Title SiYuan before v3.8.2 API Token Exposure via Log File
First Time appeared B3log
B3log siyuan
Weaknesses CWE-532
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

B3log Siyuan
Siyuan Siyuan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-05T01:18:25.477Z

Reserved: 2026-09-03T11:08:17.526Z

Link: CVE-2026-85174

cve-icon Vulnrichment

Updated: 2026-09-05T01:18:17.015Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T13:06:25.123

Modified: 2026-09-08T20:18:59.270

Link: CVE-2026-85174

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:30:05Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File