Executive brief
SiYuan is a note-taking and knowledge management application that supports publishing documents with password protection. A vulnerability in the FilterViewByPublishAccess filter allows unauthenticated or anonymous readers to view password-protected database rows and attribute view data without providing the required password, exposing document titles, block IDs, and column values. This undermines the publish-mode password protection mechanism for database and attribute view components.
Technical details
The vulnerability resides in the FilterViewByPublishAccess filter (model/publish_access.go:290) which processes attribute view and database row rendering in publish mode. The filter implements a check for the hidden/forbidden access tier but completely omits the password tier validation, whereas three sibling filters (FilterBlockAttributeViewKeysByPublishAccess, FilterBlockInfoByPublishAccess, FilterContentByPublishAccess) correctly check both tiers. An unauthenticated Reader or anonymous user (when Publish.Auth.Enable is false) can call renderAttributeView, getAttributeViewKeys, or renderSnapshotAttributeView without providing a publish password cookie and will receive all database/attribute-view rows for password-protected documents, including block IDs, titles, and column values. The vulnerability is a missing authorization check (CWE-862) and is reachable via CheckAuth-only endpoints. The fix requires adding password validation alongside the hidden/forbidden check in all three layout branches (Table, Gallery, Kanban).
Affected products
- SiYuan SiYuan < 3.7.4
Timeline
- 2026-07-23: disclosed
- 2026-08-12: advisory
- 2026-09-03: other: GHSA-j26h-r8jx-887c withdrawn as duplicate of GHSA-6mcf-g667-w3qv