CVE-2026-72804: SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are block-level and carry the block’s actual content. An anonymous reader who has never supplied a document’s password can therefore retrieve that document’s per-block content and its reference/backlink topology. Both endpoints are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymous account when Publish.Auth.Enable is false.