CyberRota Analysis
AI-GeneratedVersions of SiYuan prior to v3.8.2 are vulnerable to an information disclosure flaw in the getAttributeViewKeysByID endpoint, enabling unauthorized users to enumerate private attribute view key definitions without proper visibility checks. This vulnerability allows attackers to access sensitive key schemas, including field names and relational definitions from hidden databases. Organizations using affected versions should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.