SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

• CVE-2026-73608: 0.30% estimated exploitation activity in the next 30 days; percentile 23.35 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Scope note This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `9b8e8956f` on 2026-07-27 and is present on the current development head. No released stable version is affected.

Summary `/api/av/getAttributeViewSearchTarget` is registered with `CheckAuth` only and performs no authorization of any kind. Given a database identifier and a keyword, it searches that database's rows and returns matching content, regardless of whether the caller may see the database, the rows, or the notebook holding them. Commit `64c26e74b` on 2026-07-26 closed a reader-reachable gap on `getAttributeViewFieldViews` by adding `CheckReadonly` at router line 536. `9b8e8956f`, the following day, registered this endpoint at line 535 without it. The new route returns more than the one that was just closed: row content rather than field-visibility metadata.

Details Route. `kernel/api/router.go:535` on the development branch: ```go…

Published by the source

1 Oct 2026, 16:24 UTC

Last modified by the source

30 Oct 2026, 10:55 UTC

Source last checked

31 Oct 2026, 06:45 UTC

1. Revision 5 · amended · 31 Oct 2026

   Amended from osv record GO-2026-6632

2. Revision 4 · amended · 31 Oct 2026

   Amended from osv record GHSA-9cqf-hhrq-7v45

3. Revision 3 · amended · 26 Oct 2026

   Amended from ghsa record GHSA-9cqf-hhrq-7v45

4. Revision 2 · amended · 24 Oct 2026

   Amended from osv record GO-2026-6632

5. Revision 1 · created · 24 Oct 2026

   Published from osv record GHSA-9cqf-hhrq-7v45

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-73608

Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route
IDs: CVE-2026-73608, GHSA-9cqf-hhrq-7v45
Record: https://patchnext.com/advisories/ghsa-9cqf-hhrq-7v45 (revision 5, source checked 31 Oct 2026, 06:45 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 8.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: github.com/siyuan-note/siyuan/kernel 0.0.0-20260812083335-251596fc0de2. A vendor fix does not mean a deployment is fixed.

## Affected components
- Go github.com/siyuan-note/siyuan/kernel: affected >= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2; fixed in 0.0.0-20260812083335-251596fc0de2

## Suggested inspection (read-only)
- Go github.com/siyuan-note/siyuan/kernel: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on github.com/siyuan-note/siyuan/kernel.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://osv.dev/vulnerability/GO-2026-6632 (OSV record GO-2026-6632 lists affected ranges: Go github.com/siyuan-note/siyuan/kernel >=0.0.0-20260726161145-9b8e8956f997 <0.0.0-20260812083335-251596fc0de2 (fixed))
- Verified: https://osv.dev/vulnerability/GHSA-9cqf-hhrq-7v45 (OSV record GHSA-9cqf-hhrq-7v45 lists affected ranges: Go github.com/siyuan-note/siyuan/kernel >=0.0.0-20260726161145-9b8e8956f997 <0.0.0-20260812083335-251596fc0de2 (fixed))
- Verified: https://github.com/advisories/GHSA-9cqf-hhrq-7v45 (GitHub-reviewed advisory GHSA-9cqf-hhrq-7v45 lists affected ranges: Go github.com/siyuan-note/siyuan/kernel >=0.0.0-20260726161145-9b8e8956f997 <0.0.0-20260812083335-251596fc0de2)

Commands are suggestions: review each one before running it.