CVE-2026-72806: SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)
FilterViewByPublishAccess, the filter renderAttributeView applies for Reader sessions drops rows using only the hidden/forbidden check and never checks the publish password. Its three sibling filters all check both tiers. As a result, a publish RoleReader (or the anonymous account when Publish.Auth.Enable is false) who has not entered a document’s password still receives every database/attribute-view row bound to that password-protected document, the primary cell (title/ID) and all column values.
References
- github.com/advisories/GHSA-6mcf-g667-w3qv
- github.com/siyuan-note/siyuan/commit/768427f20f13bbd8dc4effa8aa4e1d09a7741bf4
- github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv
- nvd.nist.gov/vuln/detail/CVE-2026-72806
- www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view
Code Behaviors & Features
Detect and mitigate CVE-2026-72806 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →