SiYuan (Development Branch) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/siyuan-development-branch/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 13 Aug 2026 12:54:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in SiYuan Development Branchhttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/Thu, 13 Aug 2026 12:54:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-siyuan-auth-bypass/The SiYuan development branch contains an authorization bypass vulnerability in the /api/av/getAttributeViewSearchTarget endpoint, allowing unauthenticated users to access restricted database content.A missing authorization check has been identified in the SiYuan development branch at the /api/av/getAttributeViewSearchTarget endpoint (introduced by commit 9b8e8956f). The vulnerability allows anonymous users to query database content on published pages by providing a database identifier and a keyword. Because the endpoint registers only with 'CheckAuth' but lacks essential 'CheckReadonly', 'publish-access', or 'encrypted-notebook' gating, it effectively bypasses row-level security and filtering mechanisms designed to protect sensitive data.

While the base score for this vulnerability is 8.6, it is important to note that this flaw is restricted to the development branch and does not affect stable releases such as v3.7.3 or the current master branch. The issue was patched in v3.7.4. Defenders should ensure no development branches are deployed in production environments, as these versions may expose internal APIs to external exposure that are not gated for public access.

Impact

Successful exploitation allows an unauthenticated, remote attacker to exfiltrate database content that should otherwise be withheld by the application's native publish-access filters. This results in unauthorized disclosure of sensitive data managed within SiYuan database views.

Recommendation

  • Ensure that only stable, production-ready versions (v3.7.3 or v3.7.4) of SiYuan are deployed in your environment.
  • Audit infrastructure to identify and decommission any instances running development branch builds of SiYuan.
  • Monitor webserver logs for unauthorized access patterns or unexpected requests to the /api/av/getAttributeViewSearchTarget endpoint.
]]>highadvisory