Medium severity · published Sep 5, 2026
CVE-2026-86191
SiYuan before v3.8.2 Private Attribute View Key Enumeration
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
siyuan · siyuan-note
before 3.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86191
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86191
github.com
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839
www.vulncheck.com
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration
More from siyuan
10.0
CVE-2026-72811
SiYuan before v3.7.4 SQL Injection via backlink search
10.0
CVE-2026-69085
SiYuan before v3.7.3 SQL Injection via searchDocs
10.0
CVE-2026-69084
SiYuan before v3.7.3 SQL Injection via searchEmbedBlock
10.0
CVE-2026-69083
SiYuan before v3.7.3 SQL Injection via fullTextSearchAssetContent
10.0
CVE-2026-66012
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP