{"id":"EUVD-2026-57451","enisaUuid":"f67a64b1-e488-3bb0-aeb9-7ad1417a22a0","description":"SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view\u0027s name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.","datePublished":"Aug 12, 2026, 7:07:39 PM","dateUpdated":"Oct 29, 2026, 9:16:47 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4\nhttps://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewfieldviews\n","aliases":"CVE-2026-72791\nGHSA-xf8j-hfm6-vc9v\n","assigner":"VulnCheck","epss":0.33,"enisaIdProduct":[{"id":"4c4e06b0-9312-3fb8-bf0d-a9d46422602a","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"3.7.4-alpha.1 \u003c3.7.4-alpha.2"}],"enisaIdVendor":[{"id":"8a5779a8-3abe-3410-8654-90594ea42af3","vendor":{"name":"siyuan-note"}}],"enisaIdVulnerability":[{"id":"76d6d5cb-b3af-3b51-95fb-21c25b2ed145","vulnerability":{"id":"GHSA-xf8j-hfm6-vc9v","description":"SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view\u0027s name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4.","datePublished":"Aug 12, 2026, 9:31:41 PM","dateUpdated":"Oct 29, 2026, 9:30:41 PM","baseScore":0.0,"references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72791\nhttps://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewfieldviews\n","enisa_id":"EUVD-2026-57451\n","aliases":"CVE-2026-72791\nGHSA-xf8j-hfm6-vc9v\n","epss":0.0,"dataProcessed":"Oct 30, 2026, 1:01:07 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e8a0ac12-9d5c-3cd1-a978-06ad72132270","vulnerability":{"id":"CVE-2026-72791","description":"SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only and applies no publish-access filtering, so reader-role callers can retrieve the complete database view structure — every view\u0027s name, icon, layout type, and per-field Hidden flag — for any database whose avID is supplied, regardless of authorization. The issue was introduced by commit acfc02ee8 and fixed in v3.7.4-alpha.2.","datePublished":"Aug 12, 2026, 7:07:39 PM","dateUpdated":"Oct 29, 2026, 9:16:47 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","references":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-57v5-wqx3-cgj4\nhttps://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getattributeviewfieldviews\n","enisa_id":"EUVD-2026-57451\n","assigner":"VulnCheck","epss":0.33,"dataProcessed":"Oct 30, 2026, 1:00:38 PM","vulnerabilityProduct":[{"id":"b582d367-6fc6-3753-a1d7-173b51deb6ee","product":{"name":"SiYuan","vendor":{"name":"siyuan-note"}},"product_version":"3.7.4-alpha.1 \u003c3.7.4-alpha.2"}],"vulnerabilityVendor":[{"id":"3a72e989-021e-38d0-b09e-41683dafa737","vendor":{"name":"siyuan-note"}}]}}],"enisaIdAdvisory":[]}