CVE-2026-86192: Authorization Bypass Through User-Controlled Key in siyuan-note siyuan

CVE-2026-86192 affects SiYuan versions prior to 3.8.2, where the getAttributeViewKeys endpoint does not correctly filter private attribute-view cell values. As a result, users with publish reader access can retrieve hidden KeyValues payloads from rows associated with documents that are otherwise inaccessible to them. This leads to unauthorized disclosure of private database contents. The vulnerability is remotely exploitable without user interaction and requires low privileges (publish reader level).

Unauthorized users with publish reader privileges can access private data that should be restricted, potentially leading to exposure of sensitive information stored in the database. This bypass compromises data confidentiality but does not require elevated privileges or user interaction.

Upgrade SiYuan to version 3.8.2 or later, where this authorization bypass vulnerability has been fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the versioning information indicating the fix in 3.8.2.