SiYuan EUVD-2026-91421

Exploitation requires that a SiYuan document be published (publish feature enabled) AND that it embed a database view containing rows marked password-protected or publish-disabled; the attacker must be able to reach the published document over the network and invoke /api/export/preview. No authentication, credentials, or user interaction are needed (PR:N/UI:N), so any visitor to a qualifying published document can exploit it. Limiting factors: instances that do not use the publish feature, or published documents without embedded database views containing protected rows, are not exposed; impact is read-only disclosure of those specific rows and does not extend to integrity or availability.

The CVSS 4.0 base score of 8.7 (HIGH) is driven by a clean remote-unauthenticated profile - AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality impact (VC:H) and no integrity or availability impact. The vector is internally consistent with the description: any 'publish reader' (an unauthenticated visitor to a published SiYuan document) can abuse /api/export/preview, so network-reachable exploitation against a published document requires no credentials or user interaction, matching PR:N/UI:N. Mitigating the real-world severity: no EPSS score, CISA KEV entry, or public POC was provided, so there is no evidence of active exploitation or weaponization - this is a disclosed-and-patched flaw rather than a confirmed in-the-wild threat. Impact is also bounded to confidentiality of database rows (primary-key text and cell values) in documents that are actually published with an embedded database view; it is not RCE or full-instance compromise. Net: a credible, easy-to-exploit confidentiality issue worth prompt patching for anyone who publishes SiYuan documents, but the absence of exploitation signals and the narrow (read-only, feature-dependent) impact keep it below emergency priority. Note the CWE is CWE-862 (Missing Authorization), so the 'Authentication Bypass' tag is imprecise - this is an authorization/access-control failure, not an authentication bypass.

An organization publishes a SiYuan document that embeds a database view, intending some rows to stay hidden via password protection or the publish-disabled flag. An unauthenticated reader of that public document sends a request to /api/export/preview for the document and receives an export containing the supposedly protected rows' primary-key text and cell values. No public exploit code was identified at time of analysis, but the attack is trivial given the network, no-auth, no-interaction vector.