Vulnerability GO-2026-6430
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
September 10, 2026 at 02:48 PM UTC
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
<0.0.0-20260726004013-64c26e74bb82
<0.0.0-20260726004013-64c26e74bb82
Summary
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
Details
SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews in github.com/siyuan-note/siyuan/kernel
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 days ago
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
<0.0.0-20260808051406-3542530c505f GHSA-c8r8-95hg-mp34
<0.0.0-20260808051406-3542530c505f GHSA-c8r8-95hg-mp34
Medium Risk
7 days ago
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
<0.0.0-20260808010544-26ccb40d390e GHSA-rpx2-p6hp-x5gj
<0.0.0-20260808010544-26ccb40d390e GHSA-rpx2-p6hp-x5gj
High Risk
7 days ago
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
<0.0.0-20260731131820-67bc300b6ea6 GHSA-c8w8-3pqp-wr83
<0.0.0-20260731131820-67bc300b6ea6 GHSA-c8w8-3pqp-wr83
Medium Risk
7 days ago
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
<0.0.0-20260731093152-c7522b8db586 GHSA-4pjg-x8qj-33j5
<0.0.0-20260731093152-c7522b8db586 GHSA-4pjg-x8qj-33j5
Medium Risk
7 days ago
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
<0.0.0-20260730150429-5b42614311b0 GHSA-p4qw-vx5p-g984
<0.0.0-20260730150429-5b42614311b0 GHSA-p4qw-vx5p-g984
Impacted packages
Timeline
Published
1 month ago
September 10, 2026 at 02:48 PM UTC
Fixed (v0.0.0-20260726004013-64c26e74bb82)
3 months ago
July 26, 2026 at 12:40 AM UTC
Last Modified
16 hours ago
October 30, 2026 at 10:55 AM UTC