CVE-2026-104410

Summary

A vulnerability in SiYuan allows publish readers to access password-protected and publish-disabled database rows through the export preview API endpoint, leading to information disclosure of sensitive data that should have been restricted.

Exploitability

Exploitation is straightforward requiring only a request to the /api/export/preview endpoint with a public document embedding a database view, with no authentication or privilege requirements beyond basic access to the publish feature.

Blast radius

The impact could be significant as attackers can extract primary-key text and cell values from protected database rows, potentially exposing sensitive information across multiple documents that use database views.

Detection

Monitor for unusual requests to the /api/export/preview endpoint with embedded database view content in public documents, particularly those containing protected data rows that should not be accessible via preview exports.

Prioritized remediation

Upgrade to SiYuan 3.8.5 or later to address this information disclosure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.