GHSA-7j72-f6wg-cxw6: SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode)

SiYuan’s publish mode defines a “protected” access level: a document that is publicly listed but requires a password to read (per the product’s own UI help text, protected = “Publicly visible, requires password to access”). The password is enforced on the primary content path (getDoc, via FilterContentByPublishAccess).

Several other content-returning endpoints getHeadingChildrenDOM, getHeadingDeleteTransaction/getHeadingLevelTransaction/ getHeadingInsertTransaction, and getBacklinkDoc/getBackmentionDoc return rendered block DOM with no password check at all. Combined with reader-reachable endpoints that leak a protected document’s internal block IDs, an anonymous reader can retrieve the full body of a password-protected document without the password. This has been reproduced end-to-end on a live instance.