CVE-2026-86191CWE-639

CVE-2026-86191

Medium · published September 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T17:18Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 12:09Z
    SiYuan before v3.8.2 Private Attribute View Key Enumeration
    cvelistv5