CVE-2026-86191

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

4.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-09-05
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839

Check your stack JSON