THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-57v5-wqx3-cgj4 (medium) — SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

[GHSA] GHSA-57v5-wqx3-cgj4 (medium) — SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

highgithub_advisoriesPublished 2026-09-08

GHSA-57v5-wqx3-cgj4 Severity: medium CVE: None

SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

### Scope note (please read first)

This endpoint does not exist in v3.7.3 or on master. It was introduced on the development branch by commit `acfc02ee8` ("Improve database field visibility a

Indicators of compromise

http://127.0.0.1:6808/api/av/renderAttributeViewurl
http://127.0.0.1:6808/api/av/getAttributeViewFieldViewsurl

Original source: https://github.com/advisories/GHSA-57v5-wqx3-cgj4