Threats tagged 'ghsa-xf8j-hfm6-vc9v'

SiYuan v3.7.4-alpha.1, a pre-release version, contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. This endpoint is protected only by CheckAuth and lacks publish-access filtering, allowing users with reader roles to access the complete database view structure, including view names, icons, layout types, and per-field Hidden flags, for any database by supplying its avID. The vulnerability was introduced in a specific commit and fixed in version 3.7.4.