CVE-2026-86192 — SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payl…
Published: 2026-09-05 · CVSS: 7.1 · CVSS 4.0
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents without authorization.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7