high · 8.6CVE-2026-72798Sep 4, 2026

CVE-2026-72798: SiYuan renderAttributeView Publish-Access Filter Bypass

Shubham Kandhare
Security Engagement Manager, SecureLayer7

SiYuan's publish-mode database renderer leaks content from hidden or password-protected databases through Relation and Rollup columns, and skips row-level access checks entirely when the first column…

Packagegithub.com/siyuan-note/siyuan/kernel
Ecosystemgo
Affected< 0.0.0-20260724121519-426991d155c0
Fixed in0.0.0-20260724121519-426991d155c0
CVE-2026-72798: SiYuan renderAttributeView Publish-Access Filter Bypass

The problem

The renderAttributeView endpoint delegates row filtering to FilterViewByPublishAccess, but that function only checks the row's first cell for publish access. Relation and Rollup cells carry mirrored content from a linked database, and that linked database receives no access check at all.

Separately, when the first column holds a non-block value (Relation, Text, or a detached row), the bt == nil guard is never triggered and the row is returned with zero access evaluation. Column order is user-reorderable, so any database whose primary column is not a document block bypasses filtering entirely.

Both paths are confidentiality-only but require no credentials on instances with Publish.Auth.Enable = false.

Proof of concept

A working proof-of-concept for CVE-2026-72798 in github.com/siyuan-note/siyuan/kernel, with the exact payload below.

http
POST http://127.0.0.1:6808/api/av/renderAttributeView
Content-Type: application/json

{"id": "<DB_A_AV_ID>"}

The root cause is a missing cross-database access check in kernel/model/publish_access.go. The filter drops rows whose column-0 block is forbidden, but it never evaluates Relation.Contents or Rollup.Contents, which are populated from a separate attribute view (relationDestAv) that may live in a hidden or password-protected notebook.

The fail-open path is equally simple: bt is only assigned when row.Cells[0].Value.Block != nil. When that condition is false, bt stays nil, the if bt != nil drop block is skipped, and the row passes through unchecked. The patch (commit 426991d155c0) adds a fail-closed guard so rows with no accessible block are dropped, and walks each Relation/Rollup Contents entry through CheckBlockIdAccessableByPublishAccess before returning them.

CWE-862 (Missing Authorization).

The fix

Upgrade to SiYuan commit 426991d155c0 (pseudo-version 0.0.0-20260724121519-426991d155c0) or any tagged release that includes it. As a workaround, disable publish mode (Conf.Publish.Enable = false) or enable publish authentication (Conf.Publish.Auth.Enable = true) to eliminate anonymous access to the endpoint.

Reporter not attributed.

References: [1][2][3][4][5]

Related research