How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

413,619

Total vulnerabilities in the database

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route — github.com/siyuan-note/siyuan/kernel

Missing Authorization

Scope note

This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit 9b8e8956f on 2026-07-27 and is present on the current development head. No released stable version is affected.

Summary

/api/av/getAttributeViewSearchTarget is registered with CheckAuth only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them.

Commit 64c26e74b on 2026-07-26 closed a reader-reachable gap on getAttributeViewFieldViews by adding CheckReadonly at router line 536. 9b8e8956f, the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata.

Details

Route. kernel/api/router.go:535 on the development branch:

ginServer.Handle(&quot;POST&quot;, &quot;/api/av/getAttributeViewSearchTarget&quot;, model.CheckAuth, getAttributeViewSearchTarget)

No CheckReadonly, no CheckAdminRole.

Handler. kernel/api/av.go parses its arguments and calls model.GetAttributeViewSearchTarget(id, keywords). IsReadOnlyRoleContext, publishAccess and any encrypted-notebook check are all absent. The sink is kernel/model/attribute_view_render.go:69.

The adjacent routes make the omission stark. Lines 533 to 541 all handle the same data class:

| Line | Route | Guard | |---|---|---| | 534 | getAttributeViewKeys | CheckAuth, filters in-body for readers | | 535 | getAttributeViewSearchTarget | CheckAuth, nothing | | 536 | getAttributeViewFieldViews | CheckAuth, CheckReadonly | | 540 | searchAttributeView | CheckAuth, CheckReadonly | | 541 | getAttributeView | CheckAuth, CheckReadonly |

The guard at 536 is the one added by 64c26e74b. The new route sits directly above it without one.

Why this is not bounded by identifier guessing. The closest functional sibling, renderAttributeView, applies two distinct reader protections:

A containing-document gate, CheckAttributeViewBlockAccessableByPublishAccess, which is the full gate including CheckPublishAuthCookie.
Per-item filtering, FilterAttributeViewByPublishAccess, using the itemAccess and attributeAccess maps. This strips rows bound to restricted blocks out of views the reader is otherwise entitled to see.

The second layer is what makes this exploitable without guesswork. A reader takes a database block identifier from the published DOM of a page they are allowed to view, then queries this endpoint against that same database and receives precisely the rows renderAttributeView removed from the view they were served. GetAttributeViewSearchTarget reaches the same internal render function; it simply bypasses the API-layer gate.

Two aggravating properties.

getAttributeViewSearchMatches runs strings.Contains across every value of every key, and the response carries MatchedKeyID alongside the title. That is a substring oracle over every column, so a caller can test for content without needing to retrieve it wholesale.

The path also branches on IsEncryptedBox(tree.Box) into ParseAttributeViewInBox, so it reads encrypted notebooks while they are unlocked. isEncryptedNotebookDeniedForPublish appears seventeen times across the block, ref, outline, search and filetree paths, and does not appear in av.go at all.

Extraction is iterative. Each request returns a single row. Systematic recovery of a database therefore requires many requests rather than one bulk response. There is no rate limiting on the path, and the substring oracle narrows the search considerably, but I mention it so the effort is not overstated.

Proof of Concept

Precondition: a development-branch build, publish mode enabled (default port 6808), anonymous when Publish.Auth.Enable is false. A published page embedding a database whose view contains rows bound to blocks the reader cannot access.

Step 1, take the database block identifier from the published page's DOM. It is present in the served markup.

Step 2, confirm what the reader is supposed to see:

POST http://127.0.0.1:6808/api/av/renderAttributeView
{&quot;id&quot;:&quot;&lt;database block id&gt;&quot;}

→ 200, rows bound to restricted blocks are absent

Step 3, retrieve them anyway:

POST http://127.0.0.1:6808/api/av/getAttributeViewSearchTarget
{&quot;id&quot;:&quot;&lt;same database block id&gt;&quot;,&quot;keywords&quot;:&quot;&lt;term&gt;&quot;}

→ 200, matching rows including those step 2 withheld,
       with MatchedKeyID identifying the column that matched

The differential between steps 2 and 3, on one session against one database, is the finding.

Impact

An anonymous reader in publish mode, or any publish RoleReader, reads the content of database rows that the publish filters deliberately withhold, including rows in documents that are hidden, password-protected or forbidden, and rows in encrypted notebooks while those notebooks are unlocked. The database identifier required is published in the DOM of pages the reader is entitled to view, so no enumeration or guessing is involved. The substring matching across all columns lets a caller confirm specific content without retrieving whole rows.

Confidentiality only, with no integrity or availability impact.

Suggested fix

Add CheckReadonly at router line 535, matching lines 536, 540 and 541. If read-only roles are meant to use this endpoint, apply CheckAttributeViewBlockAccessableByPublishAccess and FilterAttributeViewByPublishAccess inside the handler as renderAttributeView does, and add the isEncryptedNotebookDeniedForPublish check that the block, ref, outline, search and filetree paths already carry.

More generally, the attribute-view routes now split between middleware-gated and in-body-gated, and a new route defaults to neither. A registration-time convention, where any new /api/av/ route is CheckReadonly unless it deliberately implements in-body filtering, would prevent this recurring.

Published: Oct 1, 2026
Updated: Oct 2, 2026
GHSA: GHSA-9cqf-hhrq-7v45
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: High
Score: 8.6
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CWEs:

CWE-862

Affected Software
References

Software	Affected versions
github.com/siyuan-note/siyuan/kernel	`>= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2`

Is kernel exposed on your perimeter?

A vulnerability database tells you what is broken. Attack surface management tells you where it is running: it discovers your internet-facing assets and flags the ones affected by issues like this one.

What is attack surface management? →

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.