SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

{
  "id": "82e8775618428359035d156c71e4217c637f84ce27697e3f21eb2823031d48ef",
  "url": "https://osv.dev/vulnerability/GHSA-j4ph-9xwf-wcj4",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering",
    "summary": "### Summary `/api/attr/getBookmarkLabels` is registered with `CheckAuth` only and applies no filtering of any kind. It runs a scan of the entire `blocks` table and returns the distinct set of every bookmark label in the workspace. An anonymous reader in publish mode receives the author's complete bookmark vocabulary, regardless of whether the bookmarked blocks live in published, hidden, password-protected or forbidden documents. The adjacent endpoint that returns bookmarks with their blocks does filter, and does so in a way that makes the intended rule explicit: it drops a label entirely when no accessible block carries it. ### Details **Route.** `kernel/api/router.go:297` on master, `:300` on the development branch: ```go ginServer.Handle(\"POST\", \"/api/attr/getBookmarkLabels\", model.CheckAuth, getBookmarkLabels) ``` No `CheckAdminRole`, no `CheckReadonly`. Reachable by the publish `RoleReader` token and anonymously when `Publish.Auth.Enable` is `false`. **The handler** (`kernel/api/attr.go`) is a single line: ```go ret.Data = model.BookmarkLabels() ``` which reaches `kernel/model/bookmark.go:184` and then `sql.QueryBookmarkLabels()` at `kernel/sql/block_query.go:315`: ```go sqlStmt := \"SELECT * FROM blocks WHERE ial LIKE ?\" // \"%bookmark=%\" // collect distinct ialAttr(block.IAL, \"bookmark\") into a set, sort, return ``` There is no notebook scoping, no path scoping, no publish-access check and no filter function anywhere on the path. Every block in the workspace carrying a bo",
    "evidence": "osv:GHSA-j4ph-9xwf-wcj4",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260812083335-251596fc0de2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-j4ph-9xwf-wcj4",
      "aliases": [
        "CVE-2026-73609",
        "GHSA-j4ph-9xwf-wcj4",
        "GO-2026-6634"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260812083335-251596fc0de2"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-j4ph-9xwf-wcj4/GHSA-j4ph-9xwf-wcj4.json"
          }
        }
      ],
      "modified": "2026-10-07T17:56:02.331448445Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73609",
        "https://github.com/siyuan-note/siyuan",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0",
        "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getbookmarklabels"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-862"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2026-10-01T16:23:37Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73609",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 97136,
  "published_at": "2026-10-01T16:23:37+00:00"
}

{
  "id": "2796aefedbc4c4ea7698c3e97d793a120ca51dd3fd58a831b4b461fafbfb208b",
  "url": "https://osv.dev/vulnerability/GO-2026-6634",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel",
    "summary": "SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering in github.com/siyuan-note/siyuan/kernel",
    "evidence": "osv:GO-2026-6634",
    "products": [
      {
        "name": {
          "value": "github.com/siyuan-note/siyuan/kernel",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260812083335-251596fc0de2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6634",
      "aliases": [
        "CVE-2026-73609",
        "GHSA-j4ph-9xwf-wcj4",
        "GO-2026-6634"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "0.0.0-20260812083335-251596fc0de2"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/siyuan-note/siyuan/kernel",
            "purl": "pkg:golang/github.com/siyuan-note/siyuan/kernel",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6634.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-07T17:45:13.471757394Z",
      "provider": "osv",
      "references": [
        "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j4ph-9xwf-wcj4",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73609",
        "https://github.com/siyuan-note/siyuan/releases/tag/v3.8.0",
        "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getbookmarklabels"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6634",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73609",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 97105,
  "published_at": "2026-10-07T14:09:59+00:00"
}