SiYuan EUVD-2026-57458

Exploitation requires that a SiYuan instance (before v3.7.4) publishes an attribute view to anonymous readers and that the published database contains a Relation or Rollup column referencing a hidden or password-protected database; the attacker then requests that published database to retrieve the related restricted content. The row-filter bypass specifically requires the targeted view to have a non-block type as its first column. Exploitation is remote and unauthenticated (PR:N/UI:N) with low complexity, but it is limited to data reachable through published views - an instance that does not expose attribute views to anonymous readers, or whose published views do not relate to restricted databases, is not exposed regardless of version.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity access with no user interaction, and the impact profile is a pure confidentiality breach (VC:H, SC:H) affecting a subsequent system - the restricted database whose secrets leak into a published one - with no integrity or availability impact, which is consistent with the described information-disclosure behavior. There is no CISA KEV listing and no EPSS score supplied here, and no public exploit has been identified, so the realistic exposure hinges on whether an instance actually publishes attribute views to anonymous readers; anyone running a public SiYuan publishing endpoint that relates to hidden or password-protected data is directly exposed, and even a mid-sized municipal IT team in koszalin running such a public workspace should treat this as urgent because exploitation needs only crafted requests and no credentials. The main uncertainty is deployment-dependent: the score assumes a published, internet-reachable workspace, so an instance that never exposes databases to anonymous readers faces materially lower real-world risk despite the 9.2 rating.

An attacker browses a publicly published SiYuan workspace and requests a published database that contains a Relation or Rollup column referencing a private, password-protected database. The server renders the related values without re-checking access, returning the protected Relation/Rollup contents to the anonymous visitor, and by targeting a view whose first column is a non-block type the attacker also retrieves rows that row-filtering should have hidden. No credentials, tooling, or user interaction are required; no public proof-of-concept has been identified.