CVE-2026-104410: SiYuan Information Disclosure Vulnerability

CVE-2026-104410 Overview

CVE-2026-104410 is an information disclosure vulnerability in SiYuan, a self-hosted personal knowledge management application. Versions prior to 3.8.5 expose protected database rows through the /api/export/preview endpoint. Publish readers can request an export preview of a public document that embeds a database view. The response leaks primary-key text and cell values from rows that should be password-protected or marked as publish-disabled. The flaw is categorized as a missing authorization issue [CWE-862].

Critical Impact
Unauthenticated or low-privilege publish readers can read database rows that administrators explicitly restricted from publication, resulting in confidentiality loss across shared SiYuan workspaces.

Affected Products

SiYuan versions prior to 3.8.5
SiYuan deployments exposing the publish/preview feature to untrusted readers
Self-hosted SiYuan instances embedding database views in public documents

Discovery Timeline

2026-10-02 - CVE-2026-104410 published to NVD
2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-104410

Vulnerability Analysis

SiYuan allows users to publish documents that embed database views. The publish layer enforces row-level restrictions such as password protection and the publish-disabled flag when rendering the document directly. The /api/export/preview endpoint, however, does not re-apply these authorization checks before returning content. Attackers who can reach the publish interface can request a preview of a public document that embeds a restricted database view. The server returns protected primary-key values and cell data in the preview response, bypassing the intended access boundary. The vulnerability affects confidentiality only; row contents are disclosed but not modified.

Root Cause

The root cause is a missing authorization check [CWE-862] on the export preview code path. The preview handler reads database rows through the same backend used by trusted editors, but omits the row-level visibility filters that the publish renderer applies. Restrictions configured at the row level, including password protection and the publish-disabled attribute, are therefore not consulted when the preview payload is assembled.

Attack Vector

Exploitation requires network access to the SiYuan publish endpoint and reader-level access to a public document that embeds a database view. The attacker submits a POST request to /api/export/preview targeting that document. The server responds with the rendered export, including the hidden rows. No user interaction, authentication, or elevated privileges are required beyond the publish reader role already available to viewers of the shared document.

No verified public proof-of-concept code has been published. See the GitHub Security Advisory GHSA-778g-gq49-fxxj and the VulnCheck Advisory on SiYuan API for additional technical context.

Detection Methods for CVE-2026-104410

Indicators of Compromise

Unexpected POST requests to /api/export/preview from external or unauthenticated clients.
Access log entries referencing published documents that embed database views immediately followed by /api/export/preview calls.
Spikes in preview request volume from single IP addresses or user agents enumerating document identifiers.

Detection Strategies

Enable verbose HTTP logging on the SiYuan reverse proxy and alert on /api/export/preview requests originating from the publish audience.
Correlate preview requests with the referenced document IDs to identify previews of documents containing restricted database views.
Review audit logs for anomalous reader sessions that fetch export previews without prior page renders.

Monitoring Recommendations

Forward SiYuan access and application logs to a centralized log platform for retention and query.
Build dashboards tracking per-source request rates against /api/export/* endpoints.
Alert when a single reader session accesses previews across multiple restricted databases within a short interval.

How to Mitigate CVE-2026-104410

Immediate Actions Required

Upgrade SiYuan to version 3.8.5 or later on all self-hosted instances.
Audit published documents that embed database views and verify which rows are marked as password-protected or publish-disabled.
Restrict network access to the SiYuan publish interface until the patch is applied.

Patch Information

The vendor released SiYuan 3.8.5, which adds the missing authorization check to the export preview path. Full remediation details are provided in GitHub Security Advisory GHSA-778g-gq49-fxxj. Administrators should upgrade to 3.8.5 or newer and restart the service.

Workarounds

Temporarily remove database view embeds from any published documents that contain protected rows.
Block external access to /api/export/preview at the reverse proxy or web application firewall until the upgrade is completed.
Disable public publishing on affected workspaces if restricted database content cannot be separated from public documents.

bash

# Example nginx snippet to block the vulnerable endpoint pre-patch
location = /api/export/preview {
    deny all;
    return 403;
}