VULNERABILITY INTELLIGENCE
CVE-2026-86191
CVSS score4.3 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2026-09-05
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.
Weakness classification
- disclosure@vulncheck.com: CWE-639