Kernel: Duplicate Advisory: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers

SiYuan before version 3.7.4 (affected versions up to 3.7.2) fails to enforce publish-access filters on five specific filetree path-resolution endpoints: getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath. When Publish.Auth.Enable is false, an unauthenticated or any publish reader token can call these endpoints to enumerate the complete private document tree. This includes mapping notebook names, folder hierarchies, document titles, and resolving title paths to document IDs, even for documents marked as hidden, password-protected, or publish-forbidden. This results in unauthorized information disclosure of private document metadata.

An attacker without authentication can enumerate the entire private document tree structure, gaining knowledge of notebook names, folder hierarchies, and document titles, including those intended to be hidden or restricted. This leads to partial confidentiality loss (information disclosure) but does not affect document integrity or availability.

Patch status is not yet confirmed — check the vendor advisory GHSA-5w7r-f4cg-rqq7 for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original GHSA advisory for official fixes or mitigations. Until patched, restrict access to the affected endpoints or enable Publish.Auth to enforce access controls.