CVE-2026-72800: SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)
POST /api/av/getAttributeViewKeysByID returns a database’s full column schema with no publish-access filtering, while its sibling getAttributeViewKeys applies the filter for reader sessions. Two further endpoints, getBlockDefIDsByRefText and getBlockRelevantIDs return workspace-wide block IDs with no publish scoping. All three are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.
References
- github.com/advisories/GHSA-5fhr-f75j-8wr9
- github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f
- github.com/siyuan-note/siyuan/commit/f36331956ae98fc5358f8f93bf1da3427221edf3
- github.com/siyuan-note/siyuan/security/advisories/GHSA-5fhr-f75j-8wr9
- nvd.nist.gov/vuln/detail/CVE-2026-72800
- www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-unfiltered-api
Code Behaviors & Features
Detect and mitigate CVE-2026-72800 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →