## SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

- 種別: advisory
- 重大度: medium
- 関連技術: go, github
- CVE: CVE-2026-73049
- 公開日時: 2026-10-23T18:30:42.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-p4qw-vx5p-g984)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-p4qw-vx5p-g984

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0
/api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…