Kernel: Duplicate Advisory: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

SiYuan versions before 3.7.4 fail to enforce publish-password tier validation in the getGraph and getLocalGraph API endpoints. This flaw permits unauthenticated attackers to retrieve sensitive block-level content from password-protected documents by calling these endpoints without supplying the required password. The vulnerability impacts confidentiality (CWE-200) but does not affect integrity or availability. It has a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating remote network exploitation with low attack complexity, no privileges or user interaction required, and a scope change. No known exploits in the wild are reported. The advisory is marked as a duplicate of GHSA-vpjw-wf5h-cgpq, and no official patch information is provided here.

An attacker can remotely and anonymously access confidential block-level content of documents that are supposed to be protected by a publish-password. This results in a complete confidentiality breach of password-protected documents without requiring authentication or user interaction. Integrity and availability are not impacted.

Patch status is not yet confirmed — check the vendor advisory GHSA-vpjw-wf5h-cgpq for current remediation guidance. Since no patch links are provided in this record, users should monitor the official SiYuan advisories and update to version 3.7.4 or later once available, as the vulnerability affects versions up to 3.7.2.