CVE-2026-86191

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.2

Description An information disclosure issue exists in the 'getAttributeViewKeysByID' endpoint. This allows users with publish reader permissions to enumerate private attribute view key definitions without the system verifying the visibility of the parent database. An attacker can use this endpoint to retrieve complete key schemas, including sensitive field names and relation definitions, from hidden databases.

Recommendations Update SiYuan to version 3.8.2 or later. As a temporary mitigation, restrict access to the 'getAttributeViewKeysByID' endpoint.