Executive brief
SiYuan is a popular open-source note-taking application that supports publishing notes with access controls. When a document is published with password protection, an unauthenticated user or reader who has not supplied the password should not be able to see the document's contents. However, a bug in the attribute-view and database display logic allows anyone to view all rows—including titles, IDs, and data columns—from password-protected documents without entering the password. This defeats the publish-password control for database views, exposing sensitive information contained in structured data like tables and galleries.
Technical details
The vulnerability is a missing authorization check in FilterViewByPublishAccess (model/publish_access.go:290), which renders database and attribute-view rows during publish-mode requests. The filter only validates the hidden/forbidden access tier using CheckPathAccessableByPublishIgnore() but completely omits the password-protection check. Three sibling filters—FilterBlockAttributeViewKeysByPublishAccess, FilterBlockInfoByPublishAccess, and FilterContentByPublishAccess—correctly enforce both the hidden/forbidden tier and the password tier (checking if password is empty or a valid publish-auth cookie exists). The vulnerability affects Table, Gallery, and Kanban layouts and is reachable via renderAttributeView, getAttributeViewKeys, and renderSnapshotAttributeView endpoints, all of which only check authentication (CheckAuth) but not password authorization. An unauthenticated or anonymous reader receives every row bound to that password-protected document, leaking confidential structured data. The fix requires adding the password check condition: if !CheckPathAccessableByPublishIgnore(...) || !(password == "" || CheckPublishAuthCookie(c, passwordID, password)) { row = nil }.
Affected products
- SiYuan SiYuan < 0.0.0-20260723040913-768427f20f13
Timeline
- 2026-09-03: disclosed: Advisory published on GitHub
- 2026-07-23: patched: Fix released in commit 768427f20f13