ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-73049

SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

Published Aug 14, 2026 · catalog updated Oct 23, 2026 · SiYuan: The publish filter

Check if you run it

No confirmed exploitation is on record for CVE-2026-73049. EPSS is 0.33%. Act only if a listed version of SiYuan: The publish filter is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (SiYuan: The publish filter).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.33%
Remediation
Version ranges on file
Affected products
Go github.com/siyuan-note/siyuan/kernel · go github.com/siyuan-note/siyuan/kernel · golang github.com · vendor siyuan-note siyuan

### Summary filters its results for reader roles through . That function resolves its ignore list with , which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that reference it. The rest of the function is correct. It takes and calls and at all four decision points, so the password-protected and private tiers are properly enforced. The defect is the choice of list, on one line. ### Details **Route,** on the development branch and on master: only. No , no . **The defect.** In ( on dev, on master): returns only entries at the forbidden tier. A hidden document has , , , so it does not appear in that list. therefore returns true for it, and because the password is empty the authentication branch short-circuits. Hidden documents pass both halves of the check. **The sibling filter uses the correct list.** The regular backlink panel is the same product feature in the same UI, and it is gated properly. calls , which at resolves its list with . Two backlink filters in the same file, opposite list choices. **The distinction the tiers are meant to draw.** The shipped description of the hidden tier, from : A direct-access endpoint using the forbidden list is consistent with that: hidden documents are meant to be reachable when the caller already knows the identifier. Backlink discovery is not direct access. The caller supplies the target row and receives the identities of referring rows it never named, which is enumeration, and enumeration is precisely what "not publicly visible" excludes. **Origin.** The filter was introduced by (2026-07-18, "Show database relation backlinks in the attribute panel", #10599) with this list choice from the start. No security-focused commit has touched the attribute-view backlink path since. **What is returned.** Per matc

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/siyuan-note/siyuan/kernel0 → 0.0.0-20260730150429-5b42614311b0
  • go github.com/siyuan-note/siyuan/kernel< 0.0.0-20260730150429-5b42614311b0
  • golang github.comversion unspecified
  • vendor siyuan-note siyuanversion unspecified

How to fix CVE-2026-73049

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-73049. EPSS is 0.33%. Act only if a listed version of SiYuan: The publish filter is installed.

Which versions are affected?

Compare what you have installed with 0 → 0.0.0-20260730150429-5b42614311b0, < 0.0.0-20260730150429-5b42614311b0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.33%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 23, 2026 · GitHub Advisory Database

    Detected

    ### Summary filters its results for reader roles through . That function resolves its ignore list with , which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that referen

  2. Oct 23, 2026 · GitHub Advisory Database

    Updated

    ### Summary filters its results for reader roles through . That function resolves its ignore list with , which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that referen

  3. Oct 23, 2026 · Go Vulnerability Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260730150429-5b42614311b0

  4. Oct 23, 2026 · Go Vulnerability Database

    Fix available

    github.com/siyuan-note/siyuan/kernel fixed in 0.0.0-20260730150429-5b42614311b0

  5. Oct 23, 2026 · Go Vulnerability Database

    Updated

    ### Summary filters its results for reader roles through . That function resolves its ignore list with , which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that referen

Sources

  • CVE.orgVulnerability recordCVE-2026-73049

    SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row id

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-73049

    30-day exploitation probability 0.33%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-p4qw-vx5p-g984

    SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-73049

    /api/av/getAttributeViewBacklinks filters its results for reader roles through FilterAttributeViewBacklinksByPublishAccess. That function resolves its ignore list with GetDisablePublishAccess, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check. The result is that an anonymous reader supplying a publicly visible database row receives

    advisories.gitlab.com
  • Go Vulnerability DatabasePackage advisoryGHSA-p4qw-vx5p-g984

    SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers

    osv.dev

References

Freshness

Last verified in this catalog Oct 24, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.