SiYuan versions prior to 3.8.2 contain an information disclosure flaw in the getAttributeViewKeysByID endpoint. The endpoint can be queried by users with publish reader permissions, allowing them to enumerate private attribute view key definitions from databases that should be hidden. As a result, attackers can retrieve full key schemas, including sensitive field names and relation definitions, and gain insight into the structure of otherwise concealed databases without any authentication beyond the publish reader role.

The vulnerability applies to Siyuan Note software, specifically the Siyuan product before version 3.8.2. Any installation of these versions that exposes the getAttributeViewKeysByID endpoint to the public or publish reader users is affected; all earlier releases share this issue.

The CVSS score of 5.3 indicates moderate severity, while no EPSS score is available and the weakness is not listed in the CISA KEV catalog. The attack vector is inferred to be a web request to the vulnerable endpoint, typically over HTTP or HTTPS. An attacker only needs publish reader access or the ability to reach the endpoint, making the vulnerability exploitable by anyone who can send the request. The impact is limited to confidentiality, as the attacker gains read access to database schemas but cannot modify data or compromise system functionality.