Kernel: Duplicate Advisory: SiYuan: Full-content disclosure of publish-disabled documents via getHeading*Transaction endpoints (publish mode): reader-reachable rendered DOM with no publish-access…

SiYuan kernel versions prior to 3.7.3 contain an information disclosure vulnerability (CWE-862) in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints. These endpoints return rendered block DOM data without enforcing publish-access checks, enabling unauthorized users to retrieve the full content of documents that are disabled for publishing. This vulnerability has a CVSS 3.1 score of 8.6 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and a high confidentiality impact. The advisory is a duplicate of GHSA-69mh-gvh4-8gp7 and has been withdrawn to avoid redundancy.

Unauthorized users, including anonymous readers or those with limited RoleReader tokens, can access full rendered content of documents that are intended to be restricted because they are publish-disabled. This leads to a high confidentiality impact without affecting integrity or availability.

A fix is available in SiYuan version 3.7.3 and later. Users should upgrade to version 3.7.3 or newer to remediate this vulnerability. Since this advisory is a duplicate and withdrawn, refer to the original advisory GHSA-69mh-gvh4-8gp7 for detailed remediation instructions.