SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

影響: go:github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0 → 0.0.0-20260730150429-5b42614311b0

/api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The…

在 GitHub Advisory Database 阅读

2026/10/24 03:30，GitHub Advisory Database 发布了“SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Go、GitHub。CVE：CVE-2026-73049。