Medium severity4.3NVD Advisory· Published Sep 5, 2026· Updated Sep 8, 2026
CVE-2026-86191
CVE-2026-86191
Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.8.2
Patches
Vulnerability mechanics
References
2News mentions
1- Siyuan Note: Batch of 13 Vulnerabilities Includes Critical XSS and DoS FlawsVypr Intelligence · Sep 5, 2026