CVE-2026-40259
Description
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler passes a caller-controlled id directly to a model function that unconditionally deletes the corresponding attribute view file from the workspace without verifying that the caller has write privileges or that the target attribute view is actually unused. An authenticated publish-service reader can permanently delete arbitrary attribute view definitions by extracting publicly exposed data-av-id values from published content, causing breakage of database views and workspace rendering until manually restored. This issue has been fixed in version 3.6.4.
How to fix
- b3log siyuan3.6.4 or later
- github.com/siyuan-note/siyuan/kernel0.0.0-20260407035653-2f416e5253f1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| b3log siyuan | v < 3.6.4 | 3.6.4 |
| github.com/siyuan-note/siyuan/kernelGo | v < 0.0.0-20260407035653-2f416e5253f1 | 0.0.0-20260407035653-2f416e5253f1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.