Skip to content
Heist/ feed
Unrated

Duplicate Advisory: SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent rout

Type: withdrawalSource: OSV1 source record

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9cqf-hhrq-7v45. This link is maintained to preserve external references. ## Original Description SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected.

Announced Source revision 1
Original source ↗

GHSA-75xh-mp4f-f2rf

Primary source · Revision 1 · Withdrawn

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-75xh-mp4f-f2rf

github.com/siyuan-note/siyuan/kernel

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0.0.0-20260726161145-9b8e8956f997"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/siyuan-note/siyuan/kernel",
      "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-75xh-mp4f-f2rf/GHSA-75xh-mp4f-f2rf.json",
      "last_known_affected_version_range": "< 0.0.0-20260812083335-251596fc0de2"
    }
  }
]

Publisher severity

critical

Source reference: /database_specific/severity

Event
#62462 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement