CVE-2026-86191

MEDIUM 4.3

SiYuan before v3.8.2 Private Attribute View Key Enumeration

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

CWE	CWE-639
Vendor	siyuan-note
Product	siyuan
Published	Sep 5, 2026
Last Updated	Sep 8, 2026

Stay Ahead of the Next One

Get instant alerts for siyuan-note siyuan

Be the first to know when new medium vulnerabilities affecting siyuan-note siyuan are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

siyuan-note / siyuan

0 < 3.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839 vulncheck.com: https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration

Credits

🔍 alham-rizvi