SiYuan CVE-2026-82652

Exploitation requires two prerequisites: SiYuan must be running in publish mode (this is not the default configuration - it must be explicitly enabled by the operator), and at least one piece of content must be marked as invisible tier. If either condition is absent there is nothing to exploit. Once those conditions are met, the CVSS vector PR:N/UI:N confirms that no credentials or user interaction are required - any network-reachable anonymous request is sufficient. The three specific pathways (SQL embed blocks, attribute-view keys, attribute-view backlinks) must be present in the published content for enumeration to yield results. Exploitation is bounded to confidentiality loss; there is no code execution or data modification capability in this vulnerability.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes the risk profile: unauthenticated network access with a bounded confidentiality impact. Real-world severity is heavily context-dependent - the damage is proportional to how sensitive the invisible-tier content is. For users sharing personal notebooks, exposed drafts or private references may be low-stakes; for teams publishing internal wikis with sensitive project details or PII behind invisible-tier controls, the exposure is more significant. No EPSS data was provided in the input, KEV status is negative, and no public POC has been identified, all of which suggest this is not yet a target of opportunistic scanning. The impact is strictly read-only - no integrity or availability risk exists - and only deployments actively using publish mode with invisible-tier content configured are affected. CVSS signals and the description are mutually consistent; there are no conflicting indicators in the available data.

An attacker discovers an internet-exposed SiYuan publish endpoint and sends ordinary HTTP requests referencing SQL embed blocks or attribute-view keys within published pages. The server returns invisible-tier content inline in the response - no authentication, no special tooling, and no prior knowledge of note IDs beyond what can be inferred from the published structure is required. No public POC has been identified at time of analysis, but the straightforward nature of the access pattern means the barrier to exploitation is low for any attacker who identifies a vulnerable instance.