CVE-2026-72798

SiYuan's publish (anonymous web access) filter for attribute views, FilterViewByPublishAccess, decides row accessibility using only the row's first cell and never inspects the remaining cells, leaving other cells returned as-is. Because Relation and Rollup cells embed mirrored content (block text, titles, and column values) pulled from a separate related database, anonymous readers of a published database can view content belonging to a related database whose host document is hidden, publish-forbidden, or password-protected. Separately, when a row's first column is not a block value (e.g., Relation or Text) or the row is detached, the accessibility check is skipped entirely and the row is returned unchecked, a fail-open condition. An unauthenticated attacker with access to a published attribute view can therefore harvest confidential content from documents and databases that were never intended to be published (CWE-862, missing authorization; CVSS 3.1 8.6 High, network vector, confidentiality-only impact with scope change across the publish trust boundary). No public proof-of-concept or in-the-wild exploitation is known; EPSS is 0.3% (17th percentile) and the issue is not in CISA KEV.

What to do: Upgrade SiYuan to a release that corrects both defects in FilterViewByPublishAccess (the patched version is not stated in the available data; check the project's release notes and advisories), noting that a fix to the row-drop condition alone closes neither defect. As interim mitigation, avoid publishing attribute views that contain Relation or Rollup columns or rows whose first column is not a block type, or make the related databases' host documents publish-accessible. Audit existing published databases for related databases hosted in hidden, publish-forbidden, or password-protected documents, and for rows whose first column is non-block since those rows bypass the access check entirely.