SiYuan CVE-2026-86191

Exploitation requires the attacker to hold a valid publish-reader session on the target SiYuan instance-an authenticated low-privilege account (PR:L per CVSS). The SiYuan publish/share feature must be enabled and accessible over the network. The attacker additionally needs at least one attribute view ID from a private database, which may be obtained by guessing, enumeration via other endpoints, or observing IDs exposed in shared (public) content on the same instance. Limiting factors: unauthenticated attackers cannot exploit this; single-user instances with no publish readers configured are not at risk; instances accessible only on localhost or a trusted LAN have a greatly reduced exposure surface.

The CVSS 4.0 score of 5.3 (Medium) reflects a limited-impact information disclosure with a low-privilege authentication prerequisite (PR:L), network attack vector, and no integrity or availability impact (VI:N/VA:N, SC:N/SI:N/SA:N). The vendor-assigned metrics align well with the described behavior: only schema metadata (field names, relation definitions) is exposed, not actual stored note content. No CISA KEV listing and no public exploit code have been identified, and the EPSS signal is not provided in the input. Real-world risk is further bounded by SiYuan's deployment profile: it is primarily a self-hosted personal or small-team tool, and the publish-reader role must first be provisioned and reachable by the attacker. The 'Authentication Bypass' tag in the input is a mislabel-exploitation requires a valid session; the bypass is an authorization (IDOR) one, not an authentication one. Overall, this is a genuine but low-urgency vulnerability: high priority for multi-user SiYuan deployments with sensitive private databases, lower priority for single-user or air-gapped instances.

An attacker who has obtained a publish-reader account on a shared SiYuan instance sends repeated GET requests to the getAttributeViewKeysByID endpoint, iterating over attribute view IDs (by guessing, incrementing, or harvesting IDs visible in shared content). For each valid ID belonging to a private or hidden database, the endpoint returns the full key schema-field names, types, and relation definitions-without checking whether the reader's session is authorized to view that database. No public exploit code is known, but the attack requires only standard HTTP requests and a valid low-privilege session.