Results for "CVE-2026-73049"
Sat, October 24Today
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0 /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…