CVE-2026-72806: Missing Authorization in siyuan-note siyuan
**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806). ### Summary `FilterViewByPublishAccess`, the filter `renderAttributeView` applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish `RoleReader` (or the anonymous account when `Publish.Auth.Enable` is `false`) who has not entered a document's password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values. ### Details `FilterViewByPublishAccess` (`model/publish_access.go:290`) drops rows on the hidden/forbidden tier only: ```go // Table (line 311), Gallery (348), Kanban (385), all identical: if !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { row = nil // hidden/forbidden dropped, but password NEVER checked } ``` The three sibling filters all check both the hidden/forbidden tier and the password tier (`password == "" || CheckPublishAuthCookie(...)`): - `FilterBlockAttributeViewKeysByPublishAccess` (line 412) - `FilterBlockInfoByPublishAccess` (line 457) - `FilterContentByPublishAccess` (line 474) So the password (protected) tier is enforced everywhere except this AV/database-view filter. Table layout masks nothing; Gallery and Kanban mask only the cover, keeping the card and its non-cover values. Reachable via `renderAttributeView`, `getAttributeViewKeys`, and `renderSnapshotAttributeView`, all `CheckAuth`-only. ### Proof of Concept Reproduced on a live instance (publish mode on 6808, anonymous Reader, no password cookie), against a password-protected document with a database/AV row. | Check | Path | Result | |---|---|---| | Control | `getDoc(secretDoc)` | 🔒 placeholder, body withheld password gate works normally | | Test | `renderAttributeView(AV)` | row leaked : `blockID=…rk7jofz`, title `secret-db-row` | | Differential (`disable=true`) | same filter | 0 rows : hidden tier correctly enforced | | Differential (password set) | same filter | 1 row : password tier bypassed | Same filter, same document, same Reader: the hidden tier drops the row, the password tier leaks it isolating the omission. ### Impact An anonymous/Reader publish user who has not supplied a protected document's password receives all attribute-view/database rows bound to that document titles, block IDs, and column values defeating the publish-password control for database views. Confidentiality-only. The hidden/forbidden tier is unaffected (correctly enforced). ### Suggested fix Add the password check to the drop condition in all three layout branches (Table, Gallery, Kanban), mirroring the sibling filters: ```go if !CheckPathAccessableByPublishIgnore(...) || !(password == "" || CheckPublishAuthCookie(c, passwordID, password)) { row = nil } ```
AI Analysis
Technical Summary
CVE-2026-72806 describes an authentication bypass vulnerability in SiYuan note-taking software prior to version 3.7.4. The issue resides in the FilterViewByPublishAccess filter, which fails to enforce password protection when rendering attribute views and database rows. As a result, unauthenticated users can retrieve password-protected document data by calling the renderAttributeView function without supplying the necessary publish password. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. There is no vendor advisory or patch information currently available, and the software is not a cloud service, so remediation status is unknown.
Potential Impact
Unauthenticated attackers can bypass password protection controls to access sensitive document data, including titles, block IDs, and column values that should be restricted. This exposure could lead to unauthorized disclosure of confidential information stored within the SiYuan note-taking application. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected SiYuan versions and consider disabling or limiting the use of the renderAttributeView functionality if possible.
CVE-2026-72806: Missing Authorization in siyuan-note siyuan
Description
**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806). ### Summary `FilterViewByPublishAccess`, the filter `renderAttributeView` applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish `RoleReader` (or the anonymous account when `Publish.Auth.Enable` is `false`) who has not entered a document's password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values. ### Details `FilterViewByPublishAccess` (`model/publish_access.go:290`) drops rows on the hidden/forbidden tier only: ```go // Table (line 311), Gallery (348), Kanban (385), all identical: if !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { row = nil // hidden/forbidden dropped, but password NEVER checked } ``` The three sibling filters all check both the hidden/forbidden tier and the password tier (`password == "" || CheckPublishAuthCookie(...)`): - `FilterBlockAttributeViewKeysByPublishAccess` (line 412) - `FilterBlockInfoByPublishAccess` (line 457) - `FilterContentByPublishAccess` (line 474) So the password (protected) tier is enforced everywhere except this AV/database-view filter. Table layout masks nothing; Gallery and Kanban mask only the cover, keeping the card and its non-cover values. Reachable via `renderAttributeView`, `getAttributeViewKeys`, and `renderSnapshotAttributeView`, all `CheckAuth`-only. ### Proof of Concept Reproduced on a live instance (publish mode on 6808, anonymous Reader, no password cookie), against a password-protected document with a database/AV row. | Check | Path | Result | |---|---|---| | Control | `getDoc(secretDoc)` | 🔒 placeholder, body withheld password gate works normally | | Test | `renderAttributeView(AV)` | row leaked : `blockID=…rk7jofz`, title `secret-db-row` | | Differential (`disable=true`) | same filter | 0 rows : hidden tier correctly enforced | | Differential (password set) | same filter | 1 row : password tier bypassed | Same filter, same document, same Reader: the hidden tier drops the row, the password tier leaks it isolating the omission. ### Impact An anonymous/Reader publish user who has not supplied a protected document's password receives all attribute-view/database rows bound to that document titles, block IDs, and column values defeating the publish-password control for database views. Confidentiality-only. The hidden/forbidden tier is unaffected (correctly enforced). ### Suggested fix Add the password check to the drop condition in all three layout branches (Table, Gallery, Kanban), mirroring the sibling filters: ```go if !CheckPathAccessableByPublishIgnore(...) || !(password == "" || CheckPublishAuthCookie(c, passwordID, password)) { row = nil } ```
CVSS v4.0
Score 6.9medium
Affected software
siyuan-note
siyuan
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-72806 describes an authentication bypass vulnerability in SiYuan note-taking software prior to version 3.7.4. The issue resides in the FilterViewByPublishAccess filter, which fails to enforce password protection when rendering attribute views and database rows. As a result, unauthenticated users can retrieve password-protected document data by calling the renderAttributeView function without supplying the necessary publish password. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity impact. There is no vendor advisory or patch information currently available, and the software is not a cloud service, so remediation status is unknown.
Potential Impact
Unauthenticated attackers can bypass password protection controls to access sensitive document data, including titles, block IDs, and column values that should be restricted. This exposure could lead to unauthorized disclosure of confidential information stored within the SiYuan note-taking application. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected SiYuan versions and consider disabling or limiting the use of the renderAttributeView functionality if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-10T15:11:49.794Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7cc90abf8831d5390772ac
Added to database: 08/12/2026, 19:27:06 UTC
Last enriched: 08/12/2026, 19:42:37 UTC
Last updated: 09/27/2026, 01:47:44 UTC
Views: 65
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.