CVE-2026-40259: 
NixOS vulnerability analysis and mitigation

CVE-2026-40259 is an improper authorization vulnerability in SiYuan, an open-source personal knowledge management system, affecting versions 3.6.3 and below. The /api/av/removeUnusedAttributeView endpoint accepts publish-service RoleReader tokens and allows authenticated low-privileged users to permanently delete arbitrary attribute view definition files from the workspace without write privileges. It was published on April 16, 2026, and patched in version 3.6.4 released on April 14, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is CWE-285 (Improper Authorization): the /api/av/removeUnusedAttributeView route is registered with only CheckAuth middleware, which accepts RoleReader tokens issued to publish-service users — no CheckAdminRole or CheckReadonly check is enforced (GitHub Advisory). The handler extracts the caller-controlled id parameter directly and passes it to model.RemoveUnusedAttributeView(avID), which unconditionally deletes data/storage/av/<id>.json if the file exists, without verifying write privileges or confirming the target is actually unused. The avID values needed to exploit this are not secret — they are widely exposed in published page markup as data-av-id HTML attributes, making them trivially discoverable by any user with access to published content (GitHub Advisory). A complete HTTP request template demonstrating exploitation is included in the public advisory.

Successful exploitation allows an authenticated publish-service reader to permanently delete arbitrary attribute view (AV) definition files from the workspace, causing breakage of database views and workspace rendering for all users until the files are manually restored from history or recreated (GitHub Advisory). The impact is limited to integrity and availability — there is no confidentiality exposure, as the attack does not expose data. Practical consequences include corruption of published database views, disruption of AV-backed relationships, and operational downtime for knowledge management workflows.

A proof-of-concept exploit in the form of a complete HTTP request template is publicly available in the GitHub Security Advisory (GitHub Advisory). The vulnerability requires only low privileges (a valid publish-service RoleReader token) and no user interaction, making it straightforward to exploit. The EPSS score is 0.000780 (approximately 0.08%), indicating low current exploitation probability. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Reconnaissance: Identify a SiYuan instance with the publish service enabled and accessible. Determine if publish authentication is required; if so, obtain valid publish-reader credentials (e.g., by registering as a reader if self-registration is permitted).
2. Extract avID: Browse published content on the SiYuan publish service and inspect the page source or DOM for data-av-id attributes present in database/attribute view blocks. These values are exposed in frontend markup and are not treated as secrets.
3. Craft the malicious request: Construct a POST request to /api/av/removeUnusedAttributeView with the extracted avID as the id parameter. The publish reverse proxy will automatically inject a valid RoleReader JWT token:

POST /api/av/removeUnusedAttributeView HTTP/1.1
Host: <target-host>:<port>
Content-Type: application/json
Authorization: Basic <publish-reader-credentials>

{"id": "<extracted-data-av-id>"}

4. Trigger deletion: Send the request. CheckAuth accepts the RoleReader token, the handler passes the attacker-controlled avID to model.RemoveUnusedAttributeView(), and the backend deletes data/storage/av/<id>.json unconditionally.
5. Observe impact: The targeted attribute view definition is permanently removed. Published and local workspace database views backed by that AV become broken, and the sync counter is incremented, propagating the deletion (GitHub Advisory).

• Network: Unexpected POST requests to /api/av/removeUnusedAttributeView originating from publish-service reader sessions or low-privileged accounts; repeated requests with different id values suggesting enumeration of attribute views.
• File System: Missing or unexpectedly deleted files under data/storage/av/*.json in the SiYuan workspace directory; gaps in AV file timestamps inconsistent with normal user activity.
• Logs: SiYuan kernel logs showing RemoveUnusedAttributeView calls with IDs not matching any scheduled cleanup operation; HTTP access logs recording POST requests to the vulnerable endpoint from publish-service IP ranges.
• Application Behavior: Database views or attribute-view-backed blocks rendering as broken or empty in both the local workspace and published content without any user-initiated deletion (GitHub Advisory).

Upgrade SiYuan to version 3.6.4 or later, which fixes the vulnerability by adding proper authorization checks to the /api/av/removeUnusedAttributeView endpoint (SiYuan v3.6.4 Release, GitHub Advisory). As an interim workaround if upgrading is not immediately possible: disable the publish service entirely, or restrict publish-service access to fully trusted users only. The recommended code-level fix is to add model.CheckAdminRole and model.CheckReadonly middleware to the route, and to validate that the target AV ID is genuinely unused before deletion.

The vulnerability was reported by researcher ch1nhpd and disclosed via GitHub Security Advisories on April 10, 2026 (GitHub Advisory). The SiYuan maintainers acknowledged and patched the issue in v3.6.4, noting "Fix some security vulnerabilities" in the release changelog (SiYuan v3.6.4 Release). Community discussion was noted on Mastodon and Bluesky, and a NixOS/nixpkgs issue was opened to track the package update (Feedly). Coverage was limited to vulnerability aggregator sites and security blogs, with no major media attention.