ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-73608

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent rout

Published Oct 1, 2026 · catalog updated Oct 30, 2026 · SiYuan: getAttributeViewSearchTarget returns database

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-73608. EPSS is 0.30%. Act only if a listed version of SiYuan: getAttributeViewSearchTarget returns database is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SiYuan: getAttributeViewSearchTarget returns database).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High8.6
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.30%
Remediation
Advisory link
Affected products
Go github.com/siyuan-note/siyuan/kernel

### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit on 2026-07-27 and is present on the current development head. No released stable version is affected. ### Summary is registered with only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them. Commit on 2026-07-26 closed a reader-reachable gap on by adding at router line 536. , the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata. ### Details **Route.** on the development branch: No , no . **Handler.** parses its arguments and calls . , and any encrypted-notebook check are all absent. The sink is . **The adjacent routes make the omission stark.** Lines 533 to 541 all handle the same data class: | Line | Route | Guard | |---|---|---| | 534 | | , filters in-body for readers | | 535 | | , nothing | | 536 | | , | | 540 | | , | | 541 | | , | The guard at 536 is the one added by . The new route sits directly above it without one. **Why this is not bounded by identifier guessing.** The closest functional sibling, , applies two distinct reader protections: 1. A containing-document gate, , which is the full gate including . 2. Per-item filtering, , using the and maps. This strips rows bound to restricted blocks out of views the reader is otherwise entitled to see. The second layer is what makes this exploitable without guesswork. A reader takes a database block identifier from the published DOM of a page they are allowed to view, then queries this endpoint against that same database and receives precisely the rows removed from the view they were served. reaches the same internal render function; it simply bypasses the API-layer gate. **Two aggra

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/siyuan-note/siyuan/kernel0.0.0-20260726161145-9b8e8956f997 → 0.0.0-20260812083335-251596fc0de2

How to fix CVE-2026-73608

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-73608. EPSS is 0.30%. Act only if a listed version of SiYuan: getAttributeViewSearchTarget returns database is installed.

Which versions are affected?

Compare what you have installed with 0.0.0-20260726161145-9b8e8956f997 → 0.0.0-20260812083335-251596fc0de2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-862: Missing Authorization. EPSS 0.30%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 1, 2026 · Go Vulnerability Database

    Detected

    ### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit on 2026-07-27 and is present on the current development head. No released stable version is affected. ### Summary is registered with only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching

  2. Oct 30, 2026 · Go Vulnerability Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260812083335-251596fc0de2

  3. Oct 30, 2026 · Go Vulnerability Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260812083335-251596fc0de2

  4. Oct 30, 2026 · Go Vulnerability Database

    Updated

    ### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit on 2026-07-27 and is present on the current development head. No released stable version is affected. ### Summary is registered with only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching

Sources

  • CVE.orgVulnerability recordCVE-2026-73608

    Official CVE identifier

    cve.org
  • Go Vulnerability DatabasePackage advisoryGHSA-9cqf-hhrq-7v45

    SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

    osv.dev
  • Go Vulnerability DatabasePackage advisoryGO-2026-6632

    SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel

    osv.dev

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Go Vulnerability DatabaseNov 4, 2026
  • Go Vulnerability DatabaseNov 4, 2026
  • CVE.orgOct 30, 2026