CVE-2026-40259 Details
Description
SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and below, the /api/av/removeUnusedAttributeView endpoint is protected only by generic authentication that accepts publish-service RoleReader tokens. The handler passes a caller-controlled id directly to a model function that unconditionally deletes the corresponding attribute view file from the workspace without verifying that the caller has write privileges or that the target attribute view is actually unused. An authenticated publish-service reader can permanently delete arbitrary attribute view definitions by extracting publicly exposed data-av-id values from published content, causing breakage of database views and workspace rendering until manually restored. This issue has been fixed in version 3.6.4.
A vulnerability exists in SiYuan versions through 3.6.3, allowing authenticated users with the publish-service RoleReader token to exploit the /api/av/removeUnusedAttributeView endpoint. This endpoint lacks proper authorization checks, enabling the deletion of arbitrary attribute view files from the workspace. The vulnerability arises because the endpoint does not verify if the caller has the right to delete or if the attribute view is genuinely unused. As a result, an authenticated publish-service reader can permanently remove attribute view definitions, disrupting database views and workspace rendering until manually restored.
Users should update to SiYuan version 3.6.4, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7m5h-w69j-qggg | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-7m5h-w69j-qggg | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 20, 2026 | CVE Modified | CISA-ADP |
| Apr 16, 2026 | New CVE Received | [email protected] |