Listen to this Post
CVE-2026-72806 is an authentication bypass vulnerability identified in the SiYuan note-taking platform. The flaw resides within the `FilterViewByPublishAccess` filter, specifically in how it handles the `renderAttributeView` function for Reader sessions.
The core issue is that this filter only checks if a document is hidden or forbidden (CheckPathAccessableByPublishIgnore) when rendering attribute views and database rows, but it completely fails to check if the document is protected by a publish password. In contrast, its three sibling filters (FilterBlockAttributeViewKeysByPublishAccess, FilterBlockInfoByPublishAccess, and FilterContentByPublishAccess) correctly enforce both the hidden/forbidden tier and the password tier.
As a result, a user with publish `RoleReader` permissions, or an anonymous user when `Publish.Auth.Enable` is set to false, can access all database and attribute-view rows bound to a password-protected document without ever entering the password. This leak includes the primary cell (/ID) and all column values.
The vulnerability is reachable via several endpoints including renderAttributeView, getAttributeViewKeys, and renderSnapshotAttributeView, all of which are only CheckAuth-protected. A proof of concept demonstrates that while the standard `getDoc` function correctly withholds content, the `renderAttributeView` function leaks the row data. The hidden/forbidden tier remains correctly enforced, isolating the omission to the password check. The suggested fix is to add the missing password check to the drop condition in all three layout branches (Table, Gallery, Kanban).
DailyCVE Form:
Platform: SiYuan
Version: < v3.7.4
Vulnerability: Authentication Bypass
Severity: Medium (CVSS 5.8)
Date: 2026-08-12
Prediction: Already Patched (v3.7.4)
What Undercode Say:
Analytics show the vulnerability is triggered by calling `renderAttributeView` without a password cookie. The following bash command can be used to simulate an unauthenticated request:
curl -X GET "http://target-si Yuan:6808/api/attribute/view/renderAttributeView?avID=<attribute_view_id>" \ -H "Cookie: " \ -H "Content-Type: application/json"
This command targets the `renderAttributeView` endpoint. If the response contains rows (s, block IDs, column values) from a password-protected document, the instance is vulnerable.
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by:
- Identifying a target SiYuan instance with Publish Mode enabled.
- Locating a password-protected document that has an associated database or attribute view.
- Sending a direct request to the `renderAttributeView` endpoint for that specific view without providing a password.
- Observing the leaked data in the response, which will include the protected document’s row data.
Protection:
To protect against this CVE:
Immediate Action: Upgrade SiYuan to version v3.7.4 or later, which contains the official fix.
Workaround: If an immediate upgrade is not possible, disable Publish Mode if it is not strictly necessary.
Network Controls: Deploy IP-based access control lists (ACLs) or a VPN to restrict access to the SiYuan server.
Configuration: Explicitly add sensitive, password-protected documents to the publish-ignore list in vulnerable versions.
Impact:
The impact of this vulnerability is a confidentiality breach. An unauthenticated or low-privileged reader can access s, block IDs, and column values of password-protected documents. This defeats the purpose of the publish-password control for database views. The attack is network-accessible and requires no user interaction, making it a significant risk for exposed instances.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
