Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis of the security advisory and the associated commit 426991d155c0c7c3a9e71badd6761eddfa8aad5b reveals an information disclosure vulnerability in SiYuan's database attribute view rendering. The root cause is an inadequate access control check within the FilterViewByPublishAccess function, which is called by the renderAttributeView API endpoint.
The vulnerability has two main aspects:
FilterViewByPublishAccess function only inspected the first cell of a database row to decide if the row was accessible. If the first cell pointed to a public document, the entire row was returned, including data in 'Relation' and 'Rollup' cells that could be mirroring content from private, unpublished, or password-protected documents. The function never checked the access permissions of the data in these subsequent cells.The patch addresses these issues by replacing the call to the vulnerable FilterViewByPublishAccess in renderAttributeView with a new, more robust function, FilterAttributeViewByPublishAccess. This new function, along with its helper functions, recursively checks the permissions of all related data within a row, ensuring that no content from unauthorized documents is leaked. It also corrects the fail-open behavior by ensuring rows are dropped by default if a proper access check cannot be performed. The function checkAttributeViewItemAccessableByPublishAccess was also modified to correctly handle different row types, preventing another bypass of security checks.
renderAttributeViewkernel/api/av.go
FilterViewByPublishAccesskernel/model/publish_access.go
checkAttributeViewItemAccessableByPublishAccesskernel/model/publish_access.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/siyuan-note/siyuan/kernel | go | < 0.0.0-20260724121519-426991d155c0 | 0.0.0-20260724121519-426991d155c0 |
The render pipeline populates them from a different attribute view e.g. kernel/model/attribute_view.go:2731:
v.GroupVal.Relation.Contents = []*av.Value{ relationDestAv.GetBlockValue(groupValue) }
relationDestAv is a separate database that may live in a hidden, publish-forbidden, or password-protected document. When a published database's row survives the filter (because its column-0 document is public), its Relation and Rollup columns return the related, non-published database's content block text, titles, and mirrored column values. FilterViewByPublishAccess performs no publish-access evaluation on Relation.Contents or Rollup.Contents.
(b) Fail-open when column 0 is not a block. bt is assigned only when row.Cells[0].Value.Block != nil. If the first column is a non-block type (Relation, Text, …) or the row is detached, bt remains nil, the if bt != nil guard is skipped, and the row is returned with no accessibility check at all. Column order is user-reorderable, so any database whose first column is not the document block bypasses row filtering entirely.
Verified at origin/master (eef105683).
Precondition: publish mode enabled (default port 6808); anonymous when Publish.Auth.Enable is false. Two databases: DB-A hosted in a published document, DB-B hosted in a publish-forbidden or password-protected document, with a Relation column in DB-A pointing at DB-B and containing a distinctive marker value.
(a) Related-database content disclosure:
POST http://127.0.0.1:6808/api/av/renderAttributeView
{"id":"<DB_A_AV_ID>"}
Rows of DB-A are returned (correctly, since its host document is public), and their Relation/Rollup cell Contents include DB-B's block text and mirrored column values, despite DB-B's host document being excluded from publishing.
(b) Fail-open row: Reorder DB-A so its first column is a non-block type (or use a detached row), mark its host document publish-forbidden, and request the same endpoint the row is returned without any accessibility evaluation.
Verification status: both defects are confirmed by code inspection at origin/master. A live demonstration requires a build from HEAD with two linked databases; available on request.
An anonymous reader (publish mode with auth disabled) or any publish RoleReader can read content from databases whose host documents are hidden, publish-forbidden, or password-protected, by requesting a published database that relates to them. Because relation graphs are commonly used to link a public index to private detail records, this exposes exactly the data the publish boundary is meant to withhold. The fail-open path additionally returns rows with no accessibility check whenever the first column is not a block value, which is a user-controlled layout property. Confidentiality-only.
In FilterViewByPublishAccess:
Relation.Contents and Rollup.Contents entry against CheckBlockIdAccessableByPublishAccess (including the publish-password tier) and drop or mask entries that fail.row.Cells[0] has no accessible block (Value.Block == nil or bt == nil), drop the row rather than returning it unchecked.