Information Disclosure Vulnerability in SiYuan by SiYuan Technology

CVE-2026-86191

What is CVE-2026-86191?

SiYuan versions prior to v3.8.2 are susceptible to an information disclosure vulnerability through the getAttributeViewKeysByID endpoint. This flaw allows unauthorized users to enumerate private attribute view key definitions without the necessary parent database visibility checks. Attackers exploiting this vulnerability can access sensitive information including detailed key schemas, revealing sensitive field names and relational data from databases that should remain hidden. It is crucial for users of SiYuan to upgrade to the latest version to mitigate these security risks.

References