CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to 3.7.4 are vulnerable due to inadequate filtering of related-database content, enabling unauthorized access to sensitive data in Relation and Rollup cells from hidden or password-protected databases. This flaw allows attackers to exploit published databases linked to restricted ones, potentially bypassing security measures and exposing confidential information. Organizations using SiYuan should prioritize updating to version 3.7.4 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.