An authorization vulnerability in SiYuan versions 3.6.3 and below allows authenticated users to perform unauthorized file deletions, resulting in significant workspace disruption.

The application fails to properly validate permissions on the /api/av/removeUnusedAttributeView endpoint, allowing users with low-privilege RoleReader tokens to execute file deletion commands. This improper authorization (CWE-285) permits an attacker to remove critical attribute view definitions without verifying ownership or usage status.

The ability for a low-privileged user to delete arbitrary attribute views can lead to the permanent loss of database structures and render the SiYuan workspace unusable. With a CVSS score of 8.1, the vulnerability presents a high risk to data integrity and system availability, potentially resulting in extensive downtime and manual recovery efforts for users relying on the platform for knowledge management.

Immediate Action: Upgrade the SiYuan kernel to version 0.0.0-20260407035653-2f416e5253f1 or the main application to version 3.6.4 or later immediately.

Proactive Monitoring: Review application access logs for unauthorized attempts to access the /api/av/ directory or abnormal frequencies of API calls related to attribute view management.

Compensating Controls: Implement strict access control lists or utilize a Web Application Firewall to block requests to the /api/av/removeUnusedAttributeView endpoint for non-administrative roles until the patch is applied.

Public Exploit Available: No (exploit_available unknown)

Given the high impact on workspace integrity and the documented existence of proof-of-concept material, organizations should treat this vulnerability with high urgency. Administrators must prioritize the deployment of the 3.6.4 update to ensure that proper authorization checks are enforced on sensitive API endpoints, thereby preventing unauthorized data destruction.