Vulnerability-Lookup

GHSA-6MCF-G667-W3QV

Vulnerability from github – Published: 2026-09-03 22:50 – Updated: 2026-09-03 22:50

Summary

SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

Details

CVE: This vulnerability corresponds to CVE-2026-72806.

Summary

FilterViewByPublishAccess, the filter renderAttributeView applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish RoleReader (or the anonymous account when Publish.Auth.Enable is false) who has not entered a document's password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values.

Details

FilterViewByPublishAccess (model/publish_access.go:290) drops rows on the hidden/forbidden tier only:

// Table (line 311), Gallery (348), Kanban (385), all identical:
if !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) {
    row = nil   // hidden/forbidden dropped, but password NEVER checked
}

The three sibling filters all check both the hidden/forbidden tier and the password tier (password == "" || CheckPublishAuthCookie(...)): - FilterBlockAttributeViewKeysByPublishAccess (line 412) - FilterBlockInfoByPublishAccess (line 457) - FilterContentByPublishAccess (line 474)

So the password (protected) tier is enforced everywhere except this AV/database-view filter. Table layout masks nothing; Gallery and Kanban mask only the cover, keeping the card and its non-cover values. Reachable via renderAttributeView, getAttributeViewKeys, and renderSnapshotAttributeView, all CheckAuth-only.

Proof of Concept

Reproduced on a live instance (publish mode on 6808, anonymous Reader, no password cookie), against a password-protected document with a database/AV row.

Check	Path	Result
Control	`getDoc(secretDoc)`	🔒 placeholder, body withheld password gate works normally
Test	`renderAttributeView(AV)`	row leaked : `blockID=…rk7jofz`, title `secret-db-row`
Differential (`disable=true`)	same filter	0 rows : hidden tier correctly enforced
Differential (password set)	same filter	1 row : password tier bypassed

Same filter, same document, same Reader: the hidden tier drops the row, the password tier leaks it isolating the omission.

Impact

An anonymous/Reader publish user who has not supplied a protected document's password receives all attribute-view/database rows bound to that document titles, block IDs, and column values defeating the publish-password control for database views. Confidentiality-only. The hidden/forbidden tier is unaffected (correctly enforced).

Suggested fix

Add the password check to the drop condition in all three layout branches (Table, Gallery, Kanban), mirroring the sibling filters:

if !CheckPathAccessableByPublishIgnore(...) ||
   !(password == "" || CheckPublishAuthCookie(c, passwordID, password)) {
    row = nil
}

Severity

5.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260723040913-768427f20f13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-72806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T22:50:49Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806).\n\n### Summary\n\n`FilterViewByPublishAccess`, the filter `renderAttributeView` applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish `RoleReader` (or the anonymous account when `Publish.Auth.Enable` is `false`) who has not entered a document\u0027s password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values.\n\n### Details\n\n`FilterViewByPublishAccess` (`model/publish_access.go:290`) drops rows on the hidden/forbidden tier only:\n```go\n// Table (line 311), Gallery (348), Kanban (385), all identical:\nif !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) {\n    row = nil   // hidden/forbidden dropped, but password NEVER checked\n}\n```\n\nThe three sibling filters all check both the hidden/forbidden tier and the password tier (`password == \"\" || CheckPublishAuthCookie(...)`):\n- `FilterBlockAttributeViewKeysByPublishAccess` (line 412)\n- `FilterBlockInfoByPublishAccess` (line 457)\n- `FilterContentByPublishAccess` (line 474)\n\nSo the password (protected) tier is enforced everywhere except this AV/database-view filter. Table layout masks nothing; Gallery and Kanban mask only the cover, keeping the card and its non-cover values. Reachable via `renderAttributeView`, `getAttributeViewKeys`, and `renderSnapshotAttributeView`, all `CheckAuth`-only.\n\n### Proof of Concept\n\nReproduced on a live instance (publish mode on 6808, anonymous Reader, no password cookie), against a password-protected document with a database/AV row.\n\n| Check | Path | Result |\n|---|---|---|\n| Control | `getDoc(secretDoc)` | \ud83d\udd12 placeholder, body withheld password gate works normally |\n| Test | `renderAttributeView(AV)` | row leaked : `blockID=\u2026rk7jofz`, title `secret-db-row` |\n| Differential (`disable=true`) | same filter | 0 rows : hidden tier correctly enforced |\n| Differential (password set) | same filter | 1 row : password tier bypassed |\n\nSame filter, same document, same Reader: the hidden tier drops the row, the password tier leaks it isolating the omission.\n\n### Impact\n\nAn anonymous/Reader publish user who has not supplied a protected document\u0027s password receives all attribute-view/database rows bound to that document titles, block IDs, and column values defeating the publish-password control for database views. Confidentiality-only. The hidden/forbidden tier is unaffected (correctly enforced).\n\n### Suggested fix\n\nAdd the password check to the drop condition in all three layout branches (Table, Gallery, Kanban), mirroring the sibling filters:\n```go\nif !CheckPathAccessableByPublishIgnore(...) ||\n   !(password == \"\" || CheckPublishAuthCookie(c, passwordID, password)) {\n    row = nil\n}\n```",
  "id": "GHSA-6mcf-g667-w3qv",
  "modified": "2026-09-03T22:50:49Z",
  "published": "2026-09-03T22:50:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72806"
    },
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/commit/768427f20f13bbd8dc4effa8aa4e1d09a7741bf4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)"
}

CVE-2026-72806 (GCVE-0-2026-72806)

Vulnerability from cvelistv5 – Published: 2026-08-12 19:07 – Updated: 2026-08-14 16:52

Title

SiYuan before v3.7.4 Authentication Bypass via Attribute View

Summary

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

5.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 19:31 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	vendor-advisory
https://www.vulncheck.com/advisories/siyuan-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: 0 , < 3.7.4 (semver) Unaffected: 3.7.4 (semver) cpe:2.3:a:b3log:siyuan::::::::

Date Public

2026-07-23 00:00

Credits

Shirshakhtml

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72806",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T19:31:28.527781Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T19:31:50.597Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "lessThan": "3.7.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.7.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.7.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Shirshakhtml"
        }
      ],
      "datePublic": "2026-07-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:52:11.604Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-6mcf-g667-w3qv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv"
        },
        {
          "name": "VulnCheck Advisory: SiYuan before v3.7.4 Authentication Bypass via Attribute View",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view"
        }
      ],
      "title": "SiYuan before v3.7.4 Authentication Bypass via Attribute View",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-72806",
    "datePublished": "2026-08-12T19:07:50.614Z",
    "dateReserved": "2026-08-10T15:11:49.794Z",
    "dateUpdated": "2026-08-14T16:52:11.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-6MCF-G667-W3QV

Summary

Details

Proof of Concept

Impact

Suggested fix

CVE-2026-72806 (GCVE-0-2026-72806)

Tags

Sightings

Nomenclature