CVE-2026-86192CWE-639

CVE-2026-86192

Medium · published September 5, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
27.8
In the wild
Unconfirmed
What it is

SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00354 · 27.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T17:18Z
References (2)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vc7j-5f5p-3x75 · [email protected]https://www.vulncheck.com/advisories/siyuan-before-3.8.2-information-disclosure-via-attribute-view · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 12:09Z
    SiYuan before v3.8.2 Information Disclosure via Attribute-View
    cvelistv5