SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-73608 · Microsoft / collected KEV context

EUVD-2026-57812

GHSA-75xh-mp4f-f2rf

GHSA-9cqf-hhrq-7v45

GO-2026-6632

cve-program · CVE-2026-73608

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget

euvd · EUVD-2026-57812

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget

nvd · CVE-2026-73608

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget

osv · GHSA-75xh-mp4f-f2rf

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://nvd.nist.gov/vuln/detail/CVE-2026-73608
• https://www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget

osv · GHSA-9cqf-hhrq-7v45

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4
• https://github.com/siyuan-note/siyuan
• https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0

osv · GO-2026-6632

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
• https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4
• https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0

• SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route · Advisory content revised · 30 Oct 2026
• SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel · Advisory content revised · 30 Oct 2026
• SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget · Affected-version evidence changed · 29 Oct 2026