What is GHSA-5p8j-x73f-mfw4?

GHSA-5p8j-x73f-mfw4 is a security advisory published by GitHub Security Advisories with Medium severity. SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the...

Which CVE IDs does GHSA-5p8j-x73f-mfw4 cover?

GHSA-5p8j-x73f-mfw4 covers the following CVE IDs: CVE-2026-86191. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5p8j-x73f-mfw4?

GHSA-5p8j-x73f-mfw4 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-5p8j-x73f-mfw4MediumCVSS 4.3

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the...

Vendor

GitHub Security Advisories

Published

September 5, 2026

Last Modified

September 5, 2026

🔗 CVE IDs covered (1)

CVE-2026-86191 →

📋 Description

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve complete key schemas including sensitive field names and relation definitions from hidden databases.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4qq-w6qx-6839
https://nvd.nist.gov/vuln/detail/CVE-2026-86191
https://www.vulncheck.com/advisories/siyuan-before-3.8.2-private-attribute-view-key-enumeration
https://github.com/advisories/GHSA-5p8j-x73f-mfw4