Kernel: Duplicate Advisory: Static-file routes bypass the publish-access controls enforced on the REST API, exposing templates, snippets and export artifacts to anonymous readers

The vulnerability in SiYuan (versions up to 3.7.2) involves an access control bypass (CWE-862) where static-file routes in the server mux do not enforce the same publish-access controls as the REST API. This discrepancy allows unauthorized reading of sensitive resources such as templates, snippets, and export artifacts by users with limited or no authentication (publish reader tokens or anonymous access in disabled-auth mode). The issue is tracked under GHSA-cm9f-w4h4-7j85 and has a CVSS 3.1 base score of 5.8 (medium severity). The advisory provided is a duplicate and withdrawn, referencing GHSA-fgmr-7w36-9qfq for the original details.

An attacker with publish reader tokens or anonymous access (when disabled-auth mode is enabled) can bypass intended access controls and read sensitive static resources that should be protected. This results in unauthorized disclosure of templates, snippets, and export artifacts. There is no indication of integrity or availability impact. The vulnerability is rated medium severity with a CVSS score of 5.8.

Patch status is not yet confirmed — check the vendor advisory GHSA-fgmr-7w36-9qfq for current remediation guidance. Since no patch links are provided here and the advisory is a duplicate, users should refer to the original advisory for updates. Until a fix is applied, restrict anonymous access and review publish reader token permissions to limit exposure.