CVE-2026-40259: SiYuan Auth Bypass Vulnerability

CVE-2026-40259 Overview

SiYuan is an open-source personal knowledge management system. A critical authorization bypass vulnerability exists in SiYuan versions 3.6.3 and below that allows authenticated publish-service readers to permanently delete arbitrary attribute view definitions. The /api/av/removeUnusedAttributeView endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens, failing to verify that the caller has write privileges or that the target attribute view is actually unused before performing deletion operations.

Critical Impact

An authenticated publish-service reader can permanently delete arbitrary attribute view definitions by extracting publicly exposed data-av-id values from published content, causing breakage of database views and workspace rendering until manually restored.

Affected Products

• SiYuan versions 3.6.3 and below
• SiYuan knowledge management system with publish-service enabled
• Self-hosted and cloud deployments with RoleReader authentication

Discovery Timeline

• April 16, 2026 - CVE-2026-40259 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40259

Vulnerability Analysis

This vulnerability is classified under CWE-285 (Improper Authorization). The core issue lies in the authentication scheme protecting the /api/av/removeUnusedAttributeView endpoint, which accepts publish-service RoleReader tokens without validating whether the authenticated user has sufficient privileges to perform write operations.

The endpoint handler passes a caller-controlled id parameter directly to a model function that unconditionally deletes the corresponding attribute view file from the workspace. This design flaw means that users with read-only permissions through the publish-service can execute destructive write operations on the underlying data store.

The attack surface is expanded by the fact that data-av-id values are publicly exposed in published content, making it trivial for an attacker to enumerate valid target identifiers for deletion.

Root Cause

The root cause is an authorization bypass vulnerability where the /api/av/removeUnusedAttributeView endpoint fails to implement proper privilege verification. The generic authentication mechanism only confirms that a valid token is present but does not enforce role-based access control to verify the caller has write privileges. Additionally, the model function responsible for deletion does not validate whether the attribute view is actually unused before removing it, compounding the access control failure.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with a publish-service RoleReader token. The attacker can extract data-av-id values from publicly accessible published content, then craft API requests to the vulnerable endpoint to delete arbitrary attribute view definitions. The attack requires only low-privilege authentication and no user interaction, making it highly exploitable in environments where publish-service is enabled.

The exploitation flow involves:

1. Authenticating with a valid publish-service RoleReader token
2. Enumerating data-av-id values from published content accessible to the attacker
3. Sending DELETE requests to /api/av/removeUnusedAttributeView with the extracted IDs
4. The server unconditionally deletes the specified attribute view files

For detailed technical information, see the GitHub Security Advisory GHSA-7m5h-w69j-qggg.

Detection Methods for CVE-2026-40259

Indicators of Compromise

• Unexpected deletion of attribute view files in the SiYuan workspace directory
• API access logs showing requests to /api/av/removeUnusedAttributeView from RoleReader tokens
• Database view errors or workspace rendering failures without user-initiated changes
• High volume of requests to the attribute view removal endpoint from a single authenticated session

Detection Strategies

• Monitor API access logs for requests to /api/av/removeUnusedAttributeView from accounts with RoleReader permissions
• Implement alerting on attribute view file deletions that correlate with publish-service token authentications
• Review authentication logs for unusual patterns of RoleReader token usage against write-operation endpoints
• Deploy file integrity monitoring on workspace directories containing attribute view definitions

Monitoring Recommendations

• Enable detailed logging for all API endpoints that modify workspace content
• Create baseline metrics for attribute view deletion operations and alert on deviations
• Implement audit trails that track which authentication tokens access sensitive deletion endpoints
• Monitor for workspace corruption symptoms such as broken database views or rendering errors

How to Mitigate CVE-2026-40259

Immediate Actions Required

• Upgrade SiYuan to version 3.6.4 or later immediately
• Review access logs for any suspicious activity targeting the /api/av/removeUnusedAttributeView endpoint
• Audit RoleReader token distribution and revoke any unnecessary or compromised tokens
• Create backups of attribute view definitions to enable recovery if exploitation has occurred

Patch Information

This vulnerability has been fixed in SiYuan version 3.6.4. The patch implements proper authorization checks to ensure that only users with write privileges can access the attribute view removal functionality. Users should upgrade immediately by downloading the latest release from the GitHub Release v3.6.4.

For complete details on the security fix, refer to the GitHub Security Advisory GHSA-7m5h-w69j-qggg.

Workarounds

• Restrict network access to the SiYuan API to trusted hosts only until patching is complete
• Disable the publish-service feature if not required for business operations
• Implement additional authentication layers or Web Application Firewall rules to block requests to /api/av/removeUnusedAttributeView from RoleReader tokens
• Monitor and backup workspace data frequently to minimize impact of potential exploitation

# Example: Restrict API access via firewall rules (adjust for your environment)
# Block external access to sensitive API endpoints until patch is applied
iptables -A INPUT -p tcp --dport 6806 -s ! 127.0.0.1 -j DROP