Kernel: Duplicate Advisory: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

SiYuan versions <=3.7.2 have a critical vulnerability where the publish-access filter in renderAttributeView does not correctly restrict access to related-database content. As a result, anonymous readers can access sensitive Relation and Rollup cell data from databases that are hidden or password-protected. Additionally, if the first column is a non-block type, row filtering can be bypassed entirely, exposing restricted content. This issue is tracked under GHSA-mg8q-52j3-w5f8 and is classified as CWE-862 (Missing Authorization). No patch links are provided in this advisory, and it is noted as a duplicate of GHSA-mfrj-v65r-979c.

The vulnerability allows unauthorized anonymous users to view sensitive content from restricted databases, including Relation and Rollup cells, which should be protected. This leads to a confidentiality breach without requiring authentication or user interaction. The bypass of row filtering further exacerbates the exposure of sensitive data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory GHSA-mfrj-v65r-979c for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original GHSA for official fixes or mitigation steps. Until patched, restrict access to published databases that relate to sensitive content and consider limiting public exposure.