CVE-2026-72791 SiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews
Attackers with reader access can retrieve full database view structures, including hidden fields, from any database in SiYuan.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72791?
CVE-2026-72791 is a medium-severity missing authorization vulnerability in siyuan-note siyuan, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view's name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.
Weakness: CWE-862
Which versions are affected by CVE-2026-72791?
How do I fix CVE-2026-72791?
No fix has been published for CVE-2026-72791 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72791 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72791 exists.
Sources
Also known as GHSA-xf8j-hfm6-vc9v.