CVE-2026-101092

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f
https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f

Configurations

No configuration.

History

01 Oct 2026, 16:17

Type	Values Removed	Values Added
References	~~() https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f -~~	() https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f -

28 Sep 2026, 22:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-28 22:17

Updated : 2026-10-01 16:17

NVD link : CVE-2026-101092

Mitre link : CVE-2026-101092

CVE.ORG link : CVE-2026-101092

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-101092", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-101092", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T15:06:04.633276Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "0", "lessThan": "3.8.4", "versionType": "semver"}, {"status": "unaffected", "version": "3.8.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/siyuan-note/siyuan", "defaultStatus": "unaffected"}]}], "published": "2026-09-28T22:17:30.603", "references": [{"url": "https://github.com/siyuan-note/siyuan/commit/48229dc76ce4212fe42295393af617947b157c15", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/siyuan-before-3.8.4-information-disclosure-via-getcurrentattrviewimages", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j9p6-5639-gf4f", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases. Attackers can call the endpoint with an unrendered database identifier obtained through related endpoints to leak detached-row image asset paths and filenames that the rendering endpoint would deny."}], "lastModified": "2026-10-01T16:17:30.753", "sourceIdentifier": "disclosure@vulncheck.com"}