CVE-2026-82652
Medium · 5.3CVSS
5.3
EPSS
—
Published
Aug 30, 2026
CISA due date
—
The record
SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and attribute-view backlinks in publish mode. Anonymous readers can enumerate invisible content through these three listing mechanisms despite admin configuration marking content unlisted.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-668
- CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to… CWE-668
- CVE-2026-85053 Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82… CWE-668
- CVE-2026-82650 SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the… CWE-668
- CVE-2026-79068 Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed… CWE-668
- CVE-2026-79031 Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a… CWE-668
- CVE-2026-72924 GitHub CLI (gh) is GitHub's official command line tool. CWE-668
- CVE-2026-73843 OpenChoreo is a complete, open-source developer platform for Kubernetes. CWE-668