CVE-2026-86191
SiYuan before v3.8.2 Private Attribute View Key Enumeration
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 8, 2026
- Reserved
- Sep 5, 2026
Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
siyuansiyuan-note |
|
References
- GitHub Security Advisory (GHSA-j4qq-w6qx-6839)vendor-advisory
- VulnCheck Advisory: SiYuan before v3.8.2 Private Attribute View Key Enumerationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.