GHSA-57v5-wqx3-cgj4: SiYuan: Database view structure (all view names, layout types and per-field visibility) is returned to anonymous readers by /api/av/getAttributeViewFieldViews

/api/av/getAttributeViewFieldViews is registered with CheckAuth only and applies no publish-access filtering. Given a database avID, it returns the complete view structure of that database: every view’s name, icon, layout type and the per-field Hidden flag, regardless of whether the caller is authorized to see that database or those views.

The route registered immediately before it, getAttributeViewKeys, does gate reader roles.