Executive brief
SiYuan is a note-taking and knowledge management application that supports publishing content with various access controls. Administrators can mark certain content as "invisible" to exclude it from public listings while keeping it unlisted. However, this application failed to enforce the invisible-tier filter in three specific locations: SQL embed blocks, attribute-view keys, and attribute-view backlinks. This allows anonymous visitors to enumerate and discover content that administrators intended to hide from public listings.
Technical details
The vulnerability is an information disclosure flaw in the publish access control logic affecting three functions in kernel/model/publish_access.go: FilterEmbedBlocksByPublishAccess, FilterBlockAttributeViewKeysByPublishAccess, and FilterAttributeViewBacklinksByPublishAccess. These functions filter collections of items returned by listing operations but only check the "Disable" tier (hard access block) and skip the "Invisible" tier filtering (unlisted content), unlike similar functions already patched in prior advisories (GHSA-4vpg-gwqq-w44c, GHSA-48p5-pffc-5r9p). The functions are reachable via kernel/api/search.go and kernel/api/av.go handlers and lack the published and unpublished filtering logic present in correctly-implemented listing functions. An unauthenticated network attacker can enumerate invisible content by querying these three vectors despite admin configuration, violating the intended access control model.
Affected products
- SiYuan SiYuan before v3.8.1
Timeline
- 2026-08-30: disclosed
- 2026: patched: Fixed in v3.8.1