Listen to this Post
CVE-2026-72798 exposes two distinct logic flaws in Anytype’s publish-access filter (FilterViewByPublishAccess) used by the `renderAttributeView` API endpoint. The filter is designed to enforce row-level visibility for published documents: when an anonymous or authenticated reader requests a view, each row is evaluated against the publish permissions of its host document. The evaluation, however, hinges entirely on the value of the row’s first cell (row.Cells
</code>). If that first cell contains a block reference, the code retrieves the block tree via `treenode.GetBlockTree` and checks whether the corresponding box path is accessible via <code>CheckPathAccessableByPublishIgnore</code>. If the check passes, the entire row is returned; if it fails, the row is dropped. This single-cell gate is the root of both vulnerabilities.
The first defect concerns Relation and Rollup cell types. These are not simple references; they carry mirrored content from a different database. The render pipeline populates them from a separate attribute view (<code>relationDestAv</code>), which may reside in a document that is hidden, publish-forbidden, or password-protected. When a published database row survives the filter because its column-0 document is public, all other cells in that row are returned as-is without any further scrutiny. This means the `Contents` field of Relation and Rollup cells—containing block text, s, and mirrored column values from the private related database—are fully exposed to the reader. The filter performs no publish-access evaluation on `Relation.Contents` or <code>Rollup.Contents</code>, effectively allowing a public row to act as a bridge to private data.
The second defect is a fail-open condition when the first column is not a block value. The code assigns `bt` only when <code>row.Cells[bash].Value.Block != nil</code>. If the first column is a non-block type such as Text, Number, Relation, or any other primitive, `bt` remains nil. The subsequent `if bt != nil` guard is skipped, and the row is returned without any accessibility check whatsoever. This is particularly dangerous because column order is user-reorderable; an attacker can simply rearrange columns in a private database so that the first column is not a block, causing the entire row to bypass the filter when the view is rendered. Detached rows also trigger the same skip.
Both flaws are confirmed by code inspection at origin/master (commit eef105683). The first flaw allows leakage of related database content even when the host document is correctly excluded from publishing. The second flaw allows unconditional row return when the first column is non-block, irrespective of any publish settings. The proof-of-concept involves enabling publish mode (default port 6808, auth disabled) and creating two databases: DB-A (published) and DB-B (private). A Relation column in DB-A pointing to DB-B with a distinctive marker yields DB-B's content upon requesting <code>/api/av/renderAttributeView</code>. Separately, reordering DB-A's columns to put a non-block type first and marking its host as publish-forbidden still returns all rows. These issues are confidentiality-only but severe due to the common use of relation graphs linking public indices to private detail records.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Anytype
Version: master eef105683
Vulnerability: Publish access bypass
Severity: Medium
date: 2026-09-04
<h2 style="color: blue;">Prediction: 2026-10-04</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
[bash]
Verify publish mode status (default auth disabled)
curl -s http://127.0.0.1:6808/api/av/renderAttributeView \
-H "Content-Type: application/json" \
-d '{"id":"<PUBLISHED_DB_AV_ID>"}' | jq '.view.rows[].cells'
Leak related private DB via Relation cell (check Contents field)
curl -s http://127.0.0.1:6808/api/av/renderAttributeView \
-H "Content-Type: application/json" \
-d '{"id":"<PUBLISHED_DB_AV_ID>"}' | jq '.view.rows[].cells[] | select(.type=="Relation") .value.Contents'
Bypass fail-open by reordering columns – first column non-block (e.g., Text)
Then request view of a publish-forbidden database – rows return unchecked
curl -s http://127.0.0.1:6808/api/av/renderAttributeView \
-H "Content-Type: application/json" \
-d '{"id":"<PRIVATE_DB_AV_ID>"}' | jq '.view.rows | length' returns >0 even if not published
Inspect specific row's first cell type
curl -s http://127.0.0.1:6808/api/av/renderAttributeView \
-H "Content-Type: application/json" \
-d '{"id":"<DB_AV_ID>"}' | jq '.view.rows[bash].cells[bash].value | has("block")'
Exploit: (Educational Purposes!)
- Enable publish mode on a running Anytype instance (default port 6808) with `Publish.Auth.Enable = false` to allow anonymous access.
- Create two databases: `DB-A` (publish-enabled) and `DB-B` (publish-forbidden or password-protected). Add a `Relation` column in `DB-A` that points to
DB-B, and insert a row linking to a distinctive block inDB-B. - Send a POST request to
http://127.0.0.1:6808/api/av/renderAttributeView` with{"id": ""} . Observe the response – the Relation cell's `Contents` array will contain the full mirrored text and values fromDB-B`, bypassing publish restrictions. - For the fail-open path, reorder columns in `DB-A` so that the first column is a `Text` or `Number` type (not a
Block). Mark the entire document as publish-forbidden. Issue the same API request; the row will be returned without any accessibility check because `bt` remains nil and the guard is skipped. This works regardless ofDB-A's publish status.
Protection: from this CVE
Apply the suggested fix in `kernel/model/publish_access.go` inside
FilterViewByPublishAccess: iterate over every cell in the row – for each `Relation.Contents` and `Rollup.Contents` entry, invoke `CheckBlockIdAccessableByPublishAccess` (including the publish-password tier) and drop or mask any entry that fails. Additionally, change the row-drop logic to fail closed: if `row.Cells[bash]` has no accessible block (Value.Block == nilorbt == nil), drop the row unconditionally rather than returning it unchecked. As a temporary mitigation, restrict `renderAttributeView` access to trusted roles, disable publish mode, or enforce strict authentication even in publish context. Monitor for patches from the vendor; backporting the fix to stable builds is recommended.
Impact:
Anonymous readers or any publish `RoleReader` can exfiltrate block text, s, and mirrored column values from private, hidden, or password-protected databases simply by querying a published database that has a Relation or Rollup pointing to them. The fail-open path further allows retrieving rows from any database whose first column is non-block, regardless of publish settings, making the entire row data accessible without any authorization check. This breaks the fundamental publish boundary, turning public views into unintentional data leaks for linked private content.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
