CVE-2026-73049: SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

/api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.

The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it.

The rest of the function is correct. It takes *gin.Context and calls GetPathPasswordByPublishAccess and CheckPublishAuthCookie at all four decision points, so the password-protected and private tiers are properly enforced. The defect is the choice of list, on one line.