CVE-2026-73608: Missing Authorization in siyuan-note siyuan
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.
AI Analysis
Technical Summary
SiYuan's development branch contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint introduced by commit 9b8e8956f. This endpoint is registered with CheckAuth only and does not enforce additional authorization controls such as CheckReadonly or publish-access gating. As a result, an anonymous user can supply a database identifier from a published page and a keyword to retrieve matching database row content, including rows normally withheld by publish filters. This flaw is not present in the stable v3.7.3 or master branches and was patched in v3.7.4. No released stable versions are affected.
Potential Impact
An attacker without privileges can access sensitive database row content that should be restricted by publish-access filters. This unauthorized data disclosure could expose confidential information from the database. However, since the vulnerability exists only in a development branch and not in any released stable version, the impact on production users is mitigated.
Mitigation Recommendations
No released stable version is affected by this vulnerability. The issue was patched in version v3.7.4. Users should upgrade to v3.7.4 or later to ensure the vulnerability is fixed. Since this is not present in stable releases, no immediate action is required for users running stable versions.
CVE-2026-73608: Missing Authorization in siyuan-note siyuan
Description
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.
CVSS v4.0
Score 9.2critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SiYuan's development branch contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint introduced by commit 9b8e8956f. This endpoint is registered with CheckAuth only and does not enforce additional authorization controls such as CheckReadonly or publish-access gating. As a result, an anonymous user can supply a database identifier from a published page and a keyword to retrieve matching database row content, including rows normally withheld by publish filters. This flaw is not present in the stable v3.7.3 or master branches and was patched in v3.7.4. No released stable versions are affected.
Potential Impact
An attacker without privileges can access sensitive database row content that should be restricted by publish-access filters. This unauthorized data disclosure could expose confidential information from the database. However, since the vulnerability exists only in a development branch and not in any released stable version, the impact on production users is mitigated.
Mitigation Recommendations
No released stable version is affected by this vulnerability. The issue was patched in version v3.7.4. Users should upgrade to v3.7.4 or later to ensure the vulnerability is fixed. Since this is not present in stable releases, no immediate action is required for users running stable versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-13T11:15:12.096Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7dbdf8bf8831d539322595
Added to database: 08/13/2026, 12:52:08 UTC
Last enriched: 08/13/2026, 12:55:06 UTC
Last updated: 08/13/2026, 15:12:03 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.