SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0
/api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…
| CVE | CVE-2026-73049 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 24. 오전 03:42 |
| 데이터 | Markdown JSON |
2026. 10. 24. 오전 03:30, GitHub Advisory Database에서 "SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-73049.