{"id":"CVE-2026-104410","published":"2026-10-02T12:17:10.520","lastModified":"2026-10-02T18:17:00.790","description":"SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain protected rows' primary-key text and cell values.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","tags":[]},{"url":"https://www.vulncheck.com/advisories/siyuan-before-3.8.5-information-disclosure-via-api-export-preview","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","tags":[]}],"exploitRefs":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","tags":[]},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-778g-gq49-fxxj","tags":[]}],"hasPoc":true,"ai":{"summary":"A vulnerability in SiYuan allows publish readers to access password-protected and publish-disabled database rows through the export preview API endpoint, leading to information disclosure of sensitive data that should have been restricted.","exploitability":"Exploitation is straightforward requiring only a request to the /api/export/preview endpoint with a public document embedding a database view, with no authentication or privilege requirements beyond basic access to the publish feature.","blast_radius":"The impact could be significant as attackers can extract primary-key text and cell values from protected database rows, potentially exposing sensitive information across multiple documents that use database views.","remediation":"Upgrade to SiYuan 3.8.5 or later to address this information disclosure vulnerability.","detection":"Monitor for unusual requests to the /api/export/preview endpoint with embedded database view content in public documents, particularly those containing protected data rows that should not be accessible via preview exports.","tags":["information-disclosure","api","database","publish"],"model":"garnet-coder","analyzedAt":"2026-10-12T09:04:01.688Z"}}