EUVD-2026-57812: missing authorization in SiYuan development branch API
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- SiYuan
- Product
- SiYuan
- First seen
Summary
The EUVD entry, scored 9.2 under CVSS v3.1, describes a missing-authorization flaw in the /api/av/getAttributeViewSearchTarget endpoint. It says the endpoint exists only in the development branch and was patched in v3.7.4-alpha.3.
If you use SiYuan
Do not run development-branch builds on exposed or shared instances
Upgrade to v3.7.4-alpha.3 or later
Restrict network access to the SiYuan API until patched
Avoid running the v3.7.4-alpha.1 pre-release
Check SiYuan release notes for a fixed build
Limit network access to the SiYuan API
What the sources say 2
· Mastodon: “SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint.” Source
· Mastodon: “SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint.” Source