MEDIUM 5.8 GitHub
CVE-2026-73049
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous read
### Summary
`/api/av/getAttributeViewBacklinks` filters its results for reader roles through `FilterAttributeViewBacklinksByPublishAccess`. That function resolves its ignore list with `GetDisablePublishAccess`, which covers only the forbidden tier. Documents at the hidden tier are absent from that list, so they pass the check.
The result is that an anonymous reader supplying a publicly visible database row receives the database name, row title and document path of rows in hidden documents that
Affected Products
- go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0
References
- https://github.com/advisories/GHSA-p4qw-vx5p-g984
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-p4qw-vx5p-g984
- https://nvd.nist.gov/vuln/detail/CVE-2026-73049
- https://github.com/siyuan-note/siyuan/commit/5b42614311b0afda29ccc65e55d74bf3e8cc9054
This medium severity vulnerability with a CVSS score of 5.8 was published on 2026-10-23 via GitHub. Affected: go/github.com/siyuan-note/siyuan/kernel < 0.0.0-20260730150429-5b42614311b0.
vulnfeed aggregates 17167 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.