SiYuan note-taking software version 3.7.4-alpha.1 has an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews API endpoint. The endpoint is protected only by a basic CheckAuth mechanism but lacks publish-access filtering, allowing users with reader roles to access detailed database view metadata—including view names, icons, layout types, and per-field Hidden flags—for any database identified by the supplied avID. This flaw was introduced by commit acfc02ee8 and has been fixed in the official release version 3.7.4. The vulnerability does not exist in stable versions 3.7.3 or earlier.

Unauthorized users with reader roles can access sensitive metadata about database views that should be restricted, potentially exposing internal structure and configuration details of databases. This information disclosure could aid attackers in understanding the database schema and planning further attacks. The vulnerability does not allow modification or deletion of data, only read access to view metadata.

Upgrade to SiYuan version 3.7.4 or later, where this vulnerability has been fixed. Since the issue is resolved in the official release, no additional mitigation is required for updated versions. For users on pre-release versions, avoid using the vulnerable endpoint or upgrade promptly.