Information Disclosure Vulnerability in SiYuan Application

CVE-2026-104410

What is CVE-2026-104410?

The SiYuan application prior to version 3.8.5 features an information disclosure vulnerability that permits unauthorized users to access sensitive data. Specifically, through the /api/export/preview endpoint, attackers can exploit this flaw to read password-protected and publish-disabled database rows. By requesting an export preview of a public document that embeds a database view, malicious entities can extract primary-key text and cell values of protected information, thereby leading to unauthorized data exposure and potential exploitation.

References