PT-2026-32054 · Siyuan · Siyuan

Published 2026-04-10 · Updated 2026-04-17 · CVE-2026-40259

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiYuan versions 3.x through 3.6.3

Description An issue exists where the '/api/av/removeUnusedAttributeView' endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler passes a caller-controlled id variable directly to a model function that deletes the corresponding attribute view file from the workspace without verifying if the caller has write privileges or if the target attribute view is actually unused. An authenticated publish-service reader can permanently delete arbitrary attribute view definitions by extracting publicly exposed data-av-id values from published content. This results in the breakage of database views and workspace rendering until they are manually restored.

Recommendations Update SiYuan to version 3.6.4. As a temporary workaround, restrict access to the '/api/av/removeUnusedAttributeView' endpoint to prevent unauthorized users from invoking it.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-40259

GHSA-7M5H-W69J-QGGG

Affected Products

Siyuan

References · 6

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7m5h-w69j-qggg · Exploit
• https://osv.dev/vulnerability/GHSA-7m5h-w69j-qggg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40259 · Security Note
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 · Note
• https://github.com/siyuan-note/siyuan · Note
• https://twitter.com/CVEnew/status/2045102634525200708 · Twitter Post