Missing Authorization in SiYuan Development Endpoint
CVE-2026-73608

9.2CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73608?

SiYuan's development branch contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. This issue allows unauthenticated users to access sensitive data by exploiting the endpoint, which does not enforce proper authorization controls. By providing a database identifier from a public page and a relevant keyword, attackers can retrieve data that is normally restricted by the application's access controls, compromising the confidentiality of the data. The vulnerability has been patched in version 3.7.4.

Affected Version(s)

siyuan 0 < 3.7.4

siyuan 3.7.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-author...
third-party-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shirshakhtml
.