CVE-2026-104410 SiYuan before 3.8.5 Information Disclosure via /api/export/preview
Attackers can read password-protected database rows via the export preview endpoint in SiYuan, exposing sensitive data to unauthorized users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104410?
CVE-2026-104410 is a high-severity missing authorization vulnerability in siyuan-note siyuan, published on 2 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.
Weakness: CWE-862
Which versions are affected by CVE-2026-104410?
How do I fix CVE-2026-104410?
No fix has been published for CVE-2026-104410 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-104410 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-104410 exists.
Sources
Also known as GHSA-778g-gq49-fxxj, GHSA-84pg-x94v-x3xr.