https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-04T19:58:53.176853+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-72806 fkie_cve-2026-72806 2026-10-04T19:58:53.219119+00:00

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.

 https://db.gcve.eu/vuln/ghsa-6mcf-g667-w3qv GHSA-6mcf-g667-w3qv — SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protec… 2026-10-04T19:58:53.219216+00:00

Affected: Go: github.com/siyuan-note/siyuan/kernel

**CVE:** This vulnerability corresponds to [CVE-2026-72806](https://nvd.nist.gov/vuln/detail/CVE-2026-72806).

### Summary

`FilterViewByPublishAccess`, the filter `renderAttributeView` applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish `RoleReader` (or the anonymous account when `Publish.Auth.Enable` is `false`) who has not entered a document's password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values.

### Details

`FilterViewByPublishAccess` (`model/publish_access.go:290`) drops rows on the hidden/forbidden tier only: ```go // Table (line 311), Gallery (348), Kanban (385), all identical: if !CheckPathAccessableByPublishIgnore(bt.BoxID, bt.Path, publishIgnore) { row = nil // hidden/forbidden dropped, but password NEVER checked } ```

The three sibling filters all check both the hidden/forbidden tier and the password tier (`password == "" || CheckPublishAuthCookie(...)`): - `FilterBlockAttributeViewKeysByPublishAccess` (line 412) - `FilterBlockInfoByPublishAccess` (line 457) - `FilterContentByPublishAccess` (line 474)

So the password (protected) tier is enforced everywhere except this AV/database-view filter. Table layout masks nothing; Gallery and Kanban mask only the cover, keeping the card and its non-cover values. Reachable via `renderAtt…