THREAT OPS › Threat News › [GHSA] GHSA-5fhr-f75j-8wr9 (medium) — SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
[GHSA] GHSA-5fhr-f75j-8wr9 (medium) — SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
GHSA-5fhr-f75j-8wr9 Severity: medium CVE: CVE-2026-72800
SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
**CVE:** This vulnerability corresponds to CVE-2026-72800.
### Summary
`POST /api/av/getAttributeViewKeysByID` returns a datab
Indicators of compromise
- CVE-2026-72800cve
- http://127.0.0.1:6808/api/av/getAttributeViewKeysByIDurl
- http://127.0.0.1:6808/api/block/getBlockDefIDsByRefTexturl
- http://127.0.0.1:6808/api/block/getBlockRelevantIDsurl
Original source: https://github.com/advisories/GHSA-5fhr-f75j-8wr9