SiYuan CVE-2026-72791

The target system must be running specifically SiYuan v3.7.4-alpha.1; the vulnerable endpoint does not exist in stable v3.7.3 or earlier, so production users on stable builds are entirely unaffected. The CheckAuth middleware is listed as a prerequisite in the CVE description, implying at minimum a valid reader-role account on the instance is required - however, the supplied CVSS 4.0 vector specifies PR:N (no privileges), creating a conflict that is not resolved by available data; authentication requirements should be confirmed via the vendor advisory at GHSA-57v5-wqx3-cgj4. The attacker must also supply a valid or discoverable avID for the target database block. No special platform, operating system configuration, or non-default feature flag is required beyond running the alpha pre-release build.

The CVSS 4.0 score of 6.9 with AV:N correctly reflects that exploitation is possible over the network. However, several factors substantially reduce real-world risk. First, the vulnerable endpoint exists only in v3.7.4-alpha.1, a pre-release build; users on stable v3.7.3 and earlier are entirely unaffected, sharply limiting the exposed population to those deliberately running alpha software. Second, the disclosure is strictly structural metadata (view names, layout types, hidden field flags) - not note content, credentials, or personally identifiable information. Third, the CVSS 4.0 vector lists PR:N (no privileges required), which conflicts with the CVE description's explicit mention of the CheckAuth middleware as a prerequisite - this discrepancy should be verified against the vendor advisory; if authentication is in fact required, the effective risk is lower than the raw score implies. No EPSS data was provided, the CVE is absent from the CISA KEV catalog, and no POC exploit code is known. This is a genuine but low-impact finding primarily affecting alpha testers rather than production deployments.

An authenticated reader-role user on a shared SiYuan instance running v3.7.4-alpha.1 sends a crafted HTTP request to /api/av/getAttributeViewFieldViews with the avID of a target database block. Because the endpoint skips publish-access filtering, the server returns the full view structure - including names, layout types, and which fields are hidden - for databases the reader has no authorized access to. No public proof-of-concept code is known at time of analysis; exploitation requires knowledge or discovery of target avID values.