CVE-2026-73608

🗓️ 13 Aug 2026 11:28:13Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 145 Views🌐 WEB

SiYuan before v3.7.4 missing authorization in getAttributeViewSearchTarget lets anonymous users read database rows.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-73608	13 Aug 202614:00	–	circl
Cvelist	CVE-2026-73608 SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget	13 Aug 202611:28	–	cvelist
EUVD	EUVD-2026-57812	13 Aug 202611:28	–	euvd
Github Security Blog	Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route	13 Aug 202612:31	–	github
Mend	CVE-2026-73608	13 Aug 202611:28	–	mend
NVD	CVE-2026-73608	13 Aug 202612:17	–	nvd
osv_ghsa	GHSA-75XH-MP4F-F2RF Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route	13 Aug 202612:31	–	osv_ghsa
osv_ghsa	GHSA-9CQF-HHRQ-7V45 SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route	1 Oct 202616:24	–	osv_ghsa
osv_go	GO-2026-6632 SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel	7 Oct 202614:09	–	osv_go
Positive Technologies	PT-2026-105492	13 Aug 202600:00	–	ptsecurity

Vulners

CNA

Node

b3log siyuanRange3.7.4–3.7.4

[
  {
    "vendor": "siyuan-note",
    "product": "siyuan",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
    "versions": [
      {
        "version": "3.7.4-alpha.2",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "3.7.4-alpha.3"
      },
      {
        "version": "3.7.4-alpha.3",
        "status": "unaffected",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45

Parameter	Position	Path	Description	CWE
database identifier	path	/api/av/getAttributeViewSearchTarget	Missing authorization check in the /api/av/getAttributeViewSearchTarget endpoint allows anonymous readers to query database row content using a database identifier and a keyword.	CWE-862
keyword	path	/api/av/getAttributeViewSearchTarget	Missing authorization check in the /api/av/getAttributeViewSearchTarget endpoint allows anonymous readers to query database row content using a database identifier and a keyword.	CWE-862

29 Oct 2026 21:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.6

CVSS 49.2

EPSS0.00305

SSVC

CWE-862