SiYuan Vulnerability: Unauthorized Access to Sensitive Content
- Severity
- HIGH
- Affected component
- siyuan (go)
- Affected versions
- <= 0.0.0-20260313024916-fd6526133bb3
- Patched version
- v3.7.4
An early warning has been issued regarding a vulnerability in SiYuan versions before v3.7.4 that may allow unauthorized access to sensitive content. Users of these versions are advised to upgrade immediately.
What happened
An early warning has been issued for a vulnerability in SiYuan versions before v3.7.4. This vulnerability reportedly fails to properly filter related-database content in the renderAttributeView function, potentially allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. The issue is under investigation and has not been exploited in the wild as of the latest reports.
The vulnerability affects the siyuan (go) component with versions up to and including 0.0.0-20260313024916-fd6526133bb3. The recommended action is to upgrade to SiYuan v3.7.4 or later to mitigate the risk of unauthorized access to sensitive content. Users should consult the primary sources for the most current information and updates on this issue.
What to do about it
- Identify and inventory all instances of SiYuan in your environment.
- Upgrade all affected instances of SiYuan to version v3.7.4 or later.
- Monitor the primary sources for updates and further instructions.
- Review access controls and permissions for sensitive databases to ensure they are appropriately protected.
- Consider implementing additional monitoring for unauthorized access attempts.
How 0Day would have caught this
siyuan is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using SiYuan versions before v3.7.4.
What should I do right now?
Upgrade to SiYuan v3.7.4 or later to mitigate the risk of unauthorized access to sensitive content.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Where can I find more information?
Consult the primary sources for the most current information and updates on this issue.