CVE-2026-72791: SiYuan Information Disclosure Flaw

CVE-2026-72791 Overview

CVE-2026-72791 is an information disclosure vulnerability in SiYuan, an open-source personal knowledge management application. The flaw affects the /api/av/getAttributeViewFieldViews endpoint introduced in v3.7.4-alpha.1. The route is registered with CheckAuth only and applies no publish-access filtering. Reader-role callers can retrieve the complete database view structure for any database whose avID is supplied, regardless of authorization. Exposed data includes every view's name, icon, layout type, and per-field Hidden flag. The vulnerability maps to [CWE-862: Missing Authorization]. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.

Critical Impact
Unauthenticated or reader-role users can enumerate database view metadata and hidden field information across any accessible SiYuan workspace database.

Affected Products

SiYuan v3.7.4-alpha.1 (pre-release)
SiYuan builds derived from commit acfc02ee8 prior to v3.7.4
Stable versions v3.7.3 and earlier are not affected

Discovery Timeline

2026-08-12 - CVE-2026-72791 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72791

Vulnerability Analysis

SiYuan exposes attribute view (database) functionality through a set of HTTP API endpoints. In v3.7.4-alpha.1, the developers added the /api/av/getAttributeViewFieldViews endpoint to return the structure of database views for a given attribute view identifier (avID).

The route wraps only the CheckAuth middleware. It omits the publish-access authorization check applied to other sensitive attribute view endpoints. As a result, any caller who satisfies session authentication, including users assigned the reader role, can request view metadata for any avID they can guess or enumerate.

The response includes each view's name, icon, layout type, and the Hidden flag for every field in the view. Fields marked hidden in the interface are still returned by this endpoint. This leaks the schema of restricted databases and reveals the existence of intentionally hidden columns.

Root Cause

The root cause is missing authorization enforcement on a newly added handler. The commit acfc02ee8 registered the endpoint with CheckAuth but did not apply the publish-access filter used by comparable routes. This is a classic [CWE-862] pattern where a sensitive read operation trusts authentication alone rather than validating the caller's role against the requested resource.

Attack Vector

An attacker with reader-role access to a SiYuan instance sends an HTTP POST request to /api/av/getAttributeViewFieldViews with a valid avID in the JSON body. The server returns the full view structure without checking whether the caller has publish or edit permissions on that database. Attackers can enumerate avID values from other API responses, exported documents, or shared links to broaden the disclosure. See the GitHub Security Advisory and the VulnCheck Advisory on Siyuan for endpoint-level detail.

Detection Methods for CVE-2026-72791

Indicators of Compromise

HTTP requests to /api/av/getAttributeViewFieldViews from reader-role accounts or unexpected source addresses
Repeated requests iterating through different avID values, indicating enumeration
Access log entries showing this endpoint on SiYuan builds tagged v3.7.4-alpha.1 or built from commit acfc02ee8

Detection Strategies

Inspect SiYuan reverse-proxy or application logs for POST requests to /api/av/getAttributeViewFieldViews and correlate the caller's role against the target database owner
Alert on any use of this endpoint by accounts that do not have publish or edit permissions on the referenced avID
Compare the deployed SiYuan binary version against the fixed release v3.7.4 to identify vulnerable instances

Monitoring Recommendations

Enable verbose access logging on the SiYuan HTTP interface and forward logs to a centralized analytics platform
Track request volume per client for attribute view endpoints and flag statistical outliers indicative of avID enumeration
Monitor for unauthenticated network exposure of the SiYuan API surface, particularly instances published to the internet without a reverse proxy authorization layer

How to Mitigate CVE-2026-72791

Immediate Actions Required

Upgrade SiYuan to v3.7.4 or later, which removes the missing-authorization condition
Audit accounts assigned the reader role and revoke access for users who do not require it
Restrict network exposure of the SiYuan API to trusted networks until the patch is deployed

Patch Information

The maintainers fixed the vulnerability in SiYuan v3.7.4. The fix adds publish-access filtering to the /api/av/getAttributeViewFieldViews handler so reader-role callers cannot retrieve view metadata for databases they do not own. Refer to the GitHub Security Advisory GHSA-57v5-wqx3-cgj4 for the release notes and remediation guidance.

Workarounds

Downgrade to stable v3.7.3 if v3.7.4 cannot be deployed immediately, since the vulnerable endpoint does not exist in that release
Block requests to /api/av/getAttributeViewFieldViews at a reverse proxy for all non-administrator sessions
Disable reader-role sharing or publish links until the upgrade is completed

bash

# Nginx snippet to block the vulnerable endpoint at the edge
location = /api/av/getAttributeViewFieldViews {
    return 403;
}