SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0
/api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…
| CVE | CVE-2026-73049 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/24 03:42 |
| データ | Markdown JSON |
2026/10/24 03:30、GitHub Advisory Databaseが「SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Go、GitHub。CVE: CVE-2026-73049。