SiYuan Missing Authorization in Attribute View Search

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

SiYuan's development branch contains a critical missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint that allows anonymous users to query sensitive database information. The vulnerability exists because the endpoint performs only basic authentication checks (CheckAuth) without implementing proper authorization controls like publish-access gating or encrypted-notebook validation. This means attackers who obtain a database identifier from a publicly shared SiYuan page can bypass access controls and retrieve attribute view search data they shouldn't access. Organizations and individuals using SiYuan's development builds between commit 9b8e8956f and v3.7.4 are at risk of unauthorized information disclosure, making this a high-severity issue affecting the confidentiality of sensitive notebook data.

Casky's skill mapping identifies this vulnerability through detection patterns aligned with MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. The platform's 283 matching skills help practitioners detect the attack chain: reconnaissance of published SiYuan pages to extract database identifiers (TA0006 credential harvesting), followed by direct API exploitation without proper session validation (TA0004 authorization bypass). Practitioners using Casky would observe findings highlighting unprotected API endpoints lacking fine-grained access controls, missing authorization decorators in web routes, and patterns where authentication presence masks authorization absence. Claude's extended reasoning capability surfaces the subtle security gap—that CheckAuth alone is insufficient without explicit permission validation—helping teams understand why this endpoint requires both authentication AND authorization checks before returning sensitive search results.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-73608.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-73608

Casky has 283 skills that investigate the attack patterns behind CVE-2026-73608. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn