GO-2026-6395 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode) in github.com/siyuan-note/siyuan/kernel

🗓️ 10 Sep 2026 14:48:42Reported by GoogleType

osv🔗 osv.dev👁 7 Views

SiYuan publish mode missing access filter on getAttributeViewKeysByID discloses database schema.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-72800	12 Aug 202619:07	–	attackerkb
Circl	CVE-2026-72800	4 Sep 202600:35	–	circl
CVE	CVE-2026-72800	12 Aug 202619:07	–	cve
Cvelist	CVE-2026-72800 SiYuan before v3.7.4 Information Disclosure via Unfiltered API	12 Aug 202619:07	–	cvelist
EUVD	EUVD-2026-57460	3 Sep 202623:04	–	euvd
Github Security Blog	SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)	3 Sep 202623:04	–	github
Github Security Blog	Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)	12 Aug 202621:31	–	github
NVD	CVE-2026-72800	12 Aug 202620:17	–	nvd
OSV	GHSA-5FHR-F75J-8WR9 SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)	3 Sep 202623:04	–	osv
Positive Technologies	PT-2026-71242	12 Aug 202600:00	–	ptsecurity

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-5fhr-f75j-8wr9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72800
github	www.github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f
github	www.github.com/siyuan-note/siyuan/commit/f36331956ae98fc5358f8f93bf1da3427221edf3
vulncheck	www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-unfiltered-api

10 Sep 2026 15:15Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.8

CVSS 46.9

EPSS0.00237

SSVC