Description
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| siyuan-note | siyuan | < 3.8.2 | 3.8.2 |
References
- GitHub Security Advisory (GHSA-vc7j-5f5p-3x75) vendor-advisory
- VulnCheck Advisory: SiYuan before v3.8.2 Information Disclosure via Attribute-View third-party-advisory