Kernel: Duplicate Advisory: Publish-boundary bypass via WebSocket broadcast: anonymous readers receive a live unfiltered feed of all edits including protected/forbidden documents (publish mode)

This vulnerability in SiYuan's kernel component affects versions prior to v3.7.4. It involves a publish-boundary bypass in WebSocket broadcast sessions, enabling anonymous readers to establish a connection and receive real-time content events. These events include edits to documents that should be protected or forbidden, effectively leaking sensitive information without requiring authentication. The vulnerability is tracked as CWE-862 (Missing Authorization). The advisory presented is a duplicate, with the original tracked as GHSA-mw8r-mw84-88v2.

Anonymous attackers can passively receive live updates of all edits, including those to password-protected and forbidden documents, without authentication. This results in a confidentiality breach of sensitive content. There is no impact on integrity or availability reported. The CVSS score is 8.6 (critical), reflecting the high severity of unauthorized data disclosure over a network attack vector with low complexity and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory GHSA-mw8r-mw84-88v2 for current remediation guidance. Since this advisory is a duplicate and no patch links are provided here, users should refer to the original advisory for official fixes or workarounds. Until patched, restrict or disable the WebSocket broadcast publish feature to prevent unauthorized access.