CVE-2026-101092: SiYuan Information Disclosure Vulnerability

CVE-2026-101092 Overview

CVE-2026-101092 is an information disclosure vulnerability in SiYuan, a personal knowledge management application, affecting versions before v3.8.4. The flaw resides in the getCurrentAttrViewImages endpoint, which fails to enforce publish-access checks at the database (attribute view) level. Publish readers can supply an unrendered database identifier obtained through related endpoints and retrieve image asset paths from databases they are not authorized to view. The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated or low-privileged publish readers can enumerate image asset paths and filenames from restricted SiYuan databases, including detached-row images that the standard rendering endpoint would refuse to return.

Affected Products

SiYuan note-taking application versions prior to v3.8.4
Deployments exposing the SiYuan kernel HTTP API to publish readers
Self-hosted SiYuan instances with publish access enabled

Discovery Timeline

2026-09-28 - CVE-2026-101092 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101092

Vulnerability Analysis

SiYuan supports a publish-access role that restricts readers to a subset of documents and databases. The getCurrentAttrViewImages endpoint in kernel/model/attribute_view.go resolves an attribute view by its avID and returns image asset references stored in that view's rows. Prior to v3.8.4, the endpoint performed row-level filtering but skipped the top-level check that gates whether the requesting role may access the parent database at all.

As a result, a publish reader could pass an avID belonging to a non-published database and receive image asset paths. Rows considered detached (not bound to a document block) bypassed the per-row filter entirely, exposing filenames and stored paths that the sibling renderAttributeView endpoint denies. The disclosure is limited to image asset metadata, not arbitrary file contents, which aligns with the low confidentiality impact reflected in the CVSS score.

Root Cause

The root cause is missing authorization on a data-retrieval endpoint. The handler trusted that downstream row filtering would enforce publish-access boundaries, but detached rows and unrendered database identifiers were never subjected to the database-level check CheckAttributeViewBlockAccessableByPublishAccess. A related contributor was GetGinContextRole returning without a safe default when the Gin context or role was absent, which weakened role enforcement in edge cases.

Attack Vector

Exploitation requires network access to the SiYuan kernel API and the publish reader role, which is often exposed to anonymous users in shared or public deployments. An attacker enumerates avID values through related endpoints, then issues a request to getCurrentAttrViewImages with the target identifier and a chosen blockID. The response contains image asset paths from the unauthorized database.

// Patch: kernel/model/attribute_view.go
// Gate current attribute view images by publish access
		logging.LogErrorf("parse attribute view [%s] failed: %s", avID, err)
		return
	}

	// Publish readers must only read images from publish-accessible databases.
	// Without a top-level gate, detached rows leak image asset paths from
	// unauthorized databases, so we align with renderAttributeView here.
	if IsReadOnlyRoleContext(c) {
		if !CheckAttributeViewBlockAccessableByPublishAccess(c, GetPublishAccess(), avID, blockID) {
			err = av.ErrAttributeViewNotFound
			return
		}
	}

	var view *av.View
	view, err = resolveAttributeViewView(attrView, viewID, "", blockID)

Source: GitHub Commit 48229dc

// Patch: kernel/model/role.go
// GetGinContextRole returns the request role; when the context or role is
// missing, it defaults to the most restricted anonymous visitor.
func GetGinContextRole(c *gin.Context) Role {
	if nil == c {
		return RoleVisitor
	}
	if role, exists := c.Get(RoleContextKey); exists {
		return role.(Role)
	}

Source: GitHub Commit 48229dc

Detection Methods for CVE-2026-101092

Indicators of Compromise

HTTP requests to the SiYuan kernel path /api/av/getCurrentAttrViewImages originating from unauthenticated or publish-reader sessions.
Repeated requests iterating distinct avID values from the same client, suggesting attribute-view enumeration.
Access log responses returning image asset paths for avID values that never appear in renderAttributeView traffic from the same session.

Detection Strategies

Deploy web server or reverse proxy rules that flag getCurrentAttrViewImages requests when the caller lacks an authenticated author role.
Correlate avID values across renderAttributeView and getCurrentAttrViewImages requests; divergence from the same client indicates probing.
Monitor for high-volume responses containing assets/ path substrings served to publish-reader sessions.

Monitoring Recommendations

Enable verbose HTTP access logging on SiYuan kernel endpoints and forward to a centralized log platform for retention and search.
Alert on anomalous request rates to /api/av/* endpoints from any single source IP.
Track the deployed SiYuan version through configuration management and alert when instances remain below v3.8.4.

How to Mitigate CVE-2026-101092

Immediate Actions Required

Upgrade SiYuan to v3.8.4 or later on all self-hosted and shared instances.
Audit publish-access configuration and disable public publish access on databases containing sensitive image assets until patched.
Review historical access logs for suspicious calls to getCurrentAttrViewImages prior to the upgrade.

Patch Information

The fix is delivered in SiYuan v3.8.4 via commit 48229dc76ce4212fe42295393af617947b157c15. The patch adds a top-level CheckAttributeViewBlockAccessableByPublishAccess gate to getCurrentAttrViewImages and hardens GetGinContextRole to return RoleVisitor when the Gin context is nil. See the GitHub Security Advisory GHSA-j9p6-5639-gf4f and the VulnCheck Advisory on Siyuan for additional detail.

Workarounds

Place SiYuan behind a reverse proxy that requires authentication for all /api/av/* routes until the upgrade is applied.
Restrict network exposure of the SiYuan kernel port to trusted IP ranges through firewall or security group policy.
Remove image assets from databases that must remain shared with publish readers if immediate patching is not feasible.

bash

# Example nginx snippet restricting the vulnerable endpoint to authenticated users
location /api/av/getCurrentAttrViewImages {
    auth_basic "SiYuan authors only";
    auth_basic_user_file /etc/nginx/.siyuan_authors;
    proxy_pass http://127.0.0.1:6806;
}