Kernel: Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)

An authentication bypass vulnerability exists in SiYuan's FilterViewByPublishAccess filter prior to version 3.7.4. The filter fails to enforce password protection when rendering attribute views and database rows, enabling unauthenticated readers to retrieve password-protected document rows by invoking renderAttributeView without supplying the necessary password. This issue is tracked under GHSA-j26h-r8jx-887c and is a duplicate of GHSA-6mcf-g667-w3qv.

Unauthenticated attackers can bypass password protection controls to access password-protected document rows, exposing titles, block IDs, and column values. The vulnerability impacts confidentiality but does not affect integrity or availability. The CVSS score of 5.8 reflects a moderate severity with network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory GHSA-6mcf-g667-w3qv for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigation steps.