Executive brief
SiYuan is a popular note-taking and knowledge management application with publish functionality. When using the publish feature, administrators can make databases publicly accessible while keeping others private. This vulnerability allows anonymous readers or users with limited permissions to access content from private databases by viewing publicly linked databases—specifically through Relation and Rollup columns that mirror data from hidden, password-protected, or permission-restricted databases. The issue also allows completely unfiltered access when a database's first column is reordered to be a non-block type, bypassing all permission checks entirely.
Technical details
The vulnerability exists in SiYuan's FilterViewByPublishAccess function (kernel/model/publish_access.go), which performs publish-access filtering on attribute view rows. The implementation checks only the first cell's Block value against publish permissions via CheckPathAccessableByPublishIgnore. However, Relation and Rollup cell types carry mirrored Content arrays sourced from separate, potentially private databases (ValueRelation.Contents and ValueRollup.Contents are never validated). When the first column's Value.Block is nil (non-block types like Text or Relation, or detached rows), the bt variable remains nil and the entire if-guard is bypassed, returning rows with zero accessibility evaluation. An unauthenticated attacker (when Publish.Auth.Enable is false) or RoleReader can POST to /api/av/renderAttributeView with a published database's ID and retrieve private database content through unfiltered Relation/Rollup columns or bypass filtering entirely by reordering column layout. Patch available in commit 426991d155c0.
Affected products
- siyuan-note siyuan < 0.0.0-20260724121519-426991d155c0
Timeline
- 2026-09-04: disclosed
- 2026-07-24: patched: Patch released in commit 426991d155c0c7c3a9e71badd6761eddfa8aad5b