Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck

CVE-2026-86191SiYuan before v3.8.2 Private Attribute View Key Enumeration

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.8.2

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-j4qq-w6qx-6839) vendor-advisory
VulnCheck Advisory: SiYuan before v3.8.2 Private Attribute View Key Enumeration third-party-advisory