CVE-2026-73608

creationtimestamp| type| source ---|---|--- 2026-08-13 14:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msxsjjfi3v25...

CVE-2026-73608 SiYuan before v3.7.4 Authorization Bypass via getAttributeViewSearchTarget

SiYuan's development branch endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4 contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization...

CVE-2026-73608

SiYuan has a missing-authorization vulnerability in the development branch for the /api/av/getAttributeViewSearchTarget endpoint. The route is protected only by CheckAuth and performs no further authorization checks, allowing anonymous readers to query with a database identifier and a keyword to ...