{"apiVersion":"1.0","identifier":"CVE-2026-73608","description":"SiYuan-s development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.","publishedAt":"2026-08-13T12:17:25","lastModifiedAt":"2026-08-26T17:04:11","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73608","cvssScore":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","epssProbability":0.00241,"riskScore":0.88,"affectedProduct":"SiYuan","affectedVersions":"unknown","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-73608","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-73608","en":"https://www.redsauce.net/en/cves/CVE-2026-73608","fr":"https://www.redsauce.net/fr/cves/CVE-2026-73608","pt":"https://www.redsauce.net/pt/cves/CVE-2026-73608","de":"https://www.redsauce.net/de/cves/CVE-2026-73608","sk":"https://www.redsauce.net/sk/cves/CVE-2026-73608","el":"https://www.redsauce.net/el/cves/CVE-2026-73608"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-73608"}}