Description

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-14T12:16:47.697Z",
  "pubdate": "2026-08-14T12:16:47.697Z",
  "executiveSummary": "SiYuan versions prior to v3.7.4 are affected by an information disclosure vulnerability residing within the getAttributeViewBacklinks endpoint.\nThe vulnerability involves improper access control enforcement, specifically the failure to consult the correct authorization structures during backlink filtering operations.\nAn unauthenticated anonymous reader can exploit this flaw by supplying a publicly visible database row identifier to systematically query and discover sensitive hidden-tier documents referencing the specified row.\nSuccessful exploitation results in the unauthorized disclosure of sensitive metadata, including the target database name, row title, and exact document path of restricted hidden documents.\nThis vulnerability presents a significant risk to data confidentiality, enabling unauthorized users to bypass visibility boundaries and harvest restricted information without holding valid authentication credentials or elevated privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from logic errors within the backend routing and authorization handling of the getAttributeViewBacklinks endpoint in SiYuan versions prior to v3.7.4.\nDuring the processing of backlink queries, the application mistakenly consults the forbidden access list instead of enforcing the required visibility list checks when filtering backlinks associated with specific database row identifiers.\nThe vulnerable component is exposed via the web application interface and is accessible over the network to unauthenticated users, as the endpoint incorrectly permits anonymous readers to execute query operations.\nThe attack flow proceeds as follows: an attacker with network access identifies or obtains a valid, publicly visible database row identifier within the SiYuan instance.\nThe attacker then crafts an HTTP request directed at the getAttributeViewBacklinks endpoint, supplying the known public row identifier as a parameter.\nDue to the flawed authorization logic, the application processes the request against the incorrect access list structure, bypassing standard security boundaries designed to restrict hidden-tier content.\nThe backend subsequently retrieves and returns backlinks pointing to the public row from documents residing in restricted hidden tiers.\nThe response payload returns unauthorized metadata to the attacker, exposing sensitive details such as the database name, row title, and the internal document path of the hidden documents.\nNo elevated privileges or prior authentication are required to execute this attack, as the endpoint fails to validate session credentials or authorization tiers for anonymous readers querying the attribute view backlinks."
}