External risk intelligence

SiYuan Missing Authorization Vulnerability in Attribute View Search API

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-73608

The vulnerability exists in a web application API endpoint that handles database queries. As SiYuan is commonly deployed as a self-hosted web application accessible over the network to provide note-taking and collaborative services, the API surface is reachable in standard internet-facing or internal-web deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in the SiYuan development branch affecting an API endpoint that handles database queries. This issue could allow unauthorized access to certain database content that should otherwise be restricted. No released stable version of SiYuan is impacted by this vulnerability.

Unauthorized access to some database content.
Confirms exposure and relevance of the issue.
Prioritize confirming relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could access sensitive information by sending specially crafted requests to an API endpoint. This requires only knowledge of a database identifier from a published page and a keyword. The vulnerability allows an anonymous reader to bypass access controls and retrieve content that should otherwise be restricted.

Requires anonymous network access.
Queries a specific API endpoint with parameters.
Exposes restricted database content.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an anonymous reader to bypass publish access controls when querying specific database row content using a published page identifier and a keyword. The affected endpoint, introduced in a development branch and patched in a later version, does not perform necessary authorization checks. No released stable version is impacted.

Published page data could be exposed.
Anonymous readers could query the endpoint.
Unauthorized content retrieval is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts only the development branch of SiYuan and is not present in any released stable versions. Owners of SiYuan deployments should first confirm if they are running the affected development code. If the development branch is in use and exposed externally or internally, identify the accountable owner, assess business criticality and reachability, and then plan remediation with the vendor.

Identify and confirm affected deployments.
Verify reachability and business criticality.
Coordinate vendor remediation planning.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan and how is it typically used?

SiYuan is a privacy-focused, personal knowledge management system. Users deploy it as a self-hosted application to create, organize, and share digital notes. It often functions as a local or network-accessible server that manages databases of information, allowing users to collaborate on content through a web-based interface.

What does CVE-2026-73608 mean by missing authorization?

This vulnerability, classified as CWE-862, occurs when software fails to verify if a user has permission to perform an action. In this instance, the /api/av/getAttributeViewSearchTarget endpoint skips security checks entirely. As a result, the system processes data requests from anyone, failing to enforce rules that should hide sensitive database rows from unauthorized readers.

How does an attacker trigger this vulnerability?

An attacker needs to send a crafted request to the specific API endpoint while providing a known database identifier and a search keyword. It is important to note that this bug does not trigger simply by browsing the application; it requires knowledge of a published page identifier to successfully target and retrieve the protected database content.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because SiYuan is typically deployed as a web-accessible service, this API endpoint is reachable in both standard internet-facing and internal network configurations. You should consider this a relevant concern if your instance is network-accessible, as the vulnerability resides in the application's core API surface.

Do I need to patch my SiYuan installation immediately?

First, verify your version, as this issue is specific to the development branch and does not affect released stable versions. If you are running the development code, you should prioritize confirming your deployment's status and reachability. Since stable releases are safe, the primary action is to ensure you are not using unreleased, experimental build versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.