CVE-2026-73608

Name of the Vulnerable Software and Affected Versions SiYuan development branch versions prior to 3.7.4

Description A missing-authorization issue exists in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and lacks necessary authorization checks, such as CheckReadonly, publish-access, or encrypted-notebook gating. An anonymous reader can use a database identifier from a published page and a keyword to query the endpoint and retrieve matching database row content, including data that should be withheld by publish filters (FilterAttributeViewByPublishAccess).

Recommendations Update to version 3.7.4. As a temporary workaround, restrict access to the /api/av/getAttributeViewSearchTarget endpoint.