Kernel: Duplicate Advisory: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)

SiYuan versions prior to v3.7.4 fail to enforce publish-access filtering on the getAttributeViewKeysByID API endpoint, enabling authenticated users to retrieve detailed database column schema information including descriptions, select vocabularies, and template expressions. Furthermore, the getBlockDefIDsByRefText and getBlockRelevantIDs endpoints allow enumeration of block IDs across the workspace without respecting publish boundaries, which can disclose valid block identifiers from hidden or password-protected content. This vulnerability is categorized under CWE-862 (Missing Authorization). The advisory is marked as a duplicate of GHSA-5fhr-f75j-8wr9 and has been withdrawn to preserve external references.

An authenticated user can access sensitive schema details of the database and enumerate block IDs beyond their intended publish scope. This may lead to unauthorized disclosure of metadata and identifiers related to hidden or protected documents. The CVSS score is 5.8 (medium severity), indicating limited confidentiality impact without integrity or availability effects. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory GHSA-5fhr-f75j-8wr9 for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigations. No specific patch links are provided in this record.