https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 12:14:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-72798 <p>SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.</p> <p>SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.</p> https://db.gcve.eu/vuln/fkie_cve-2026-72798 https://db.gcve.eu/vuln/ghsa-mfrj-v65r-979c <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798).</p> <p>### Summary</p> <p>`renderAttributeView` correctly applies the reader publish-access filter, but the filter&#39;s row-accessibility decision is keyed solely to the row&#39;s **first cell**, and it never inspects the remaining cells&#39; values. Relation and Rollup cells carry mirrored content from a *different* database, so a row belonging to a published database can hand an anonymous reader the contents of a related database whose host document is hidden, publish-forbidden, or password-protected. Separately, when the first column is not a block value the accessibility check is skipped entirely and the row is returned unchecked.</p> <p>### Note:</p> <p>This is distinct from the previously reported password-tier omission in the same function that concerns the row&#39;s own primary block, whereas these two defects concern (a) other cells&#39; related-database content, which no row-level check covers and (b) rows where the first cell is not a block at all. A fix to the row-drop condition alone would close neither.</p> <p>### Details</p> <p>`renderAttributeView` applies the filter (`kernel/api/av.go:68`): ```go retDataMap[&#34;view&#34;] = model.FilterViewByPublishAccess(c, publishAccess, retDataMap[&#34;view&#34;].(av.Viewable)) ```</p> <p>Inside `FilterViewByPublishAccess` (`kernel/model/publish_access.go`): ```go if row.Cells[0].Value.Block != nil { bt = treenode.GetBlockTree(row.Cells[0].Value.Block.ID) } if bt != nil { if !Chec…</p> <p><strong>Affected:</strong> Go: github.com/siyuan-note/siyuan/kernel</p> <p>**CVE:** This vulnerability corresponds to [CVE-2026-72798](https://nvd.nist.gov/vuln/detail/CVE-2026-72798).</p> <p>### Summary</p> <p>`renderAttributeView` correctly applies the reader publish-access filter, but the filter&#39;s row-accessibility decision is keyed solely to the row&#39;s **first cell**, and it never inspects the remaining cells&#39; values. Relation and Rollup cells carry mirrored content from a *different* database, so a row belonging to a published database can hand an anonymous reader the contents of a related database whose host document is hidden, publish-forbidden, or password-protected. Separately, when the first column is not a block value the accessibility check is skipped entirely and the row is returned unchecked.</p> <p>### Note:</p> <p>This is distinct from the previously reported password-tier omission in the same function that concerns the row&#39;s own primary block, whereas these two defects concern (a) other cells&#39; related-database content, which no row-level check covers and (b) rows where the first cell is not a block at all. A fix to the row-drop condition alone would close neither.</p> <p>### Details</p> <p>`renderAttributeView` applies the filter (`kernel/api/av.go:68`): ```go retDataMap[&#34;view&#34;] = model.FilterViewByPublishAccess(c, publishAccess, retDataMap[&#34;view&#34;].(av.Viewable)) ```</p> <p>Inside `FilterViewByPublishAccess` (`kernel/model/publish_access.go`): ```go if row.Cells[0].Value.Block != nil { bt = treenode.GetBlockTree(row.Cells[0].Value.Block.ID) } if bt != nil { if !Chec…</p> https://db.gcve.eu/vuln/ghsa-mfrj-v65r-979c