8 matches found
EUVD-2026-88560
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2026-101092
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2026-101092
SiYuan versions before v3.8.4 are vulnerable to an information disclosure flaw in the getCurrentAttrViewImages endpoint. The root cause is a failure to enforce publish-access checks , which allows users with publish reader permissions to retrieve image asset paths and filenames from unauthorized ...
CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2026-101092 SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
CVE-2026-101092: Exposure of Sensitive Information to an Unauthorized Actor
SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to le...
PT-2026-102388
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Insufficient publish-access checks in the 'getCurrentAttrViewImages' endpoint allow users with publish reader permissions to retrieve image asset paths from unauthorized databases. By providing an...