{"vulnerability": "GHSA-9CQF-HHRQ-7V45", "sightings": [{"uuid": "f4fbad51-c00b-4922-a925-7a847c801da5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9CQF-HHRQ-7V45", "type": "seen", "source": "https://gist.github.com/alon710/aa4cd70425279281117ff59e55aa0197", "content": "# GHSA-9CQF-HHRQ-7V45: Missing publish-access check on getAttributeViewSearchTarget endpoint exposes database row content to unauthorized readers\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-01\n> **Full Report:** https://cvereports.com/reports/GHSA-9CQF-HHRQ-7V45\n\n## Summary\nAn authorization bypass and information leakage vulnerability exists in the SiYuan database module. Unauthenticated users can query the getAttributeViewSearchTarget API endpoint using target block identifiers to extract private content.\n\n## TL;DR\nMissing publish-access check on the /api/av/getAttributeViewSearchTarget endpoint in SiYuan allows unauthorized substring-based extraction of private database row contents.\n\n## Technical Details\n\n- **CWE ID**: CWE-862, CWE-200\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SiYuan Knowledge Workspace Platform\n- **SiYuan**: < 3.8.0 (Fixed in: `3.8.0`)\n\n## Mitigation\n\n- Apply server-side publish-access middleware to validate block accessibility.\n- Restrict API endpoint access via network ACLs or reverse proxy configuration.\n- Disable public publishing features if private data is stored.\n\n**Remediation Steps:**\n1. Upgrade SiYuan to version 3.8.0 or later where access checks are properly enforced.\n2. Configure reverse proxy rules to block external access to /api/av/getAttributeViewSearchTarget.\n3. Audit published notebooks to ensure no private database blocks are referenced.\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-9CQF-HHRQ-7V45) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-01T18:30:29.000000Z"}]}