GHSA-7m5h-w69j-qggg
High · 8.1SiYuan: Publish Reader Can Arbitrarily Delete Attribute View Files via `/api/av/removeUnusedAttributeView`
CVSS
8.1
EPSS
—
Published
Apr 10, 2026
CISA due date
—
The record
An authenticated publish-service reader can invoke `/api/av/removeUnusedAttributeView` and cause persistent deletion of arbitrary attribute view (`AV`) definition files from the workspace. The route is protected only by generic `CheckAuth`, which accepts publish `RoleReader` requests. The handler forwards a caller-controlled `id` directly into a model function that deletes `data/storage/av/<id>.json` without verifying either: - that the caller is allowed to perform write/destructive actions; or - that the target AV is actually unused. This is a persistent integrity and availability issue reachable from the publish surface.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-40259 SiYuan is an open-source personal knowledge management system. Same vulnerability
- CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain… CWE-285
- CVE-2026-21097 Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1… CWE-285
- CVE-2026-86804 A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. CWE-285
- CVE-2026-86277 A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management &… CWE-285
- CVE-2026-86283 MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp)… CWE-285
- CVE-2026-86212 A vulnerability has been found in Open5GS 2.7.7/2.8.0. CWE-285
- CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. CWE-285