Description

SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers can access password-protected document rows including titles, block IDs, and column values by calling renderAttributeView without supplying the required password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-12T20:17:52.680Z",
  "pubdate": "2026-08-12T20:17:52.680Z",
  "executiveSummary": "An authentication bypass vulnerability exists in SiYuan versions prior to v3.7.4.\nThe vulnerability resides within the FilterViewByPublishAccess filter, which improperly fails to enforce publish password protection mechanisms when processing requests to render attribute views and database rows.\nUnauthenticated malicious actors or readers can leverage this flaw to successfully access sensitive, password-protected document rows, including critical metadata such as document titles, block IDs, and specific column values.\nExploitation requires no prior authentication or administrative privileges, allowing remote unauthenticated attackers to bypass confidentiality controls simply by invoking the vulnerable renderAttributeView function without supplying the mandatory password.\nThe risk implication is a direct compromise of data confidentiality for protected publications within affected SiYuan instances.\nRemediation requires upgrading the SiYuan application to version v3.7.4 or later where the access control logic is properly enforced.",
  "technicalDetails": "The vulnerability is classified as an authentication bypass resulting from insufficient access control enforcement in the publishing and filtering subsystem of SiYuan.\nThe vulnerable component is identified as the FilterViewByPublishAccess filter, which is responsible for evaluating access constraints and validating publish password protection for published documents and embedded database views.\nSpecifically, when handling requests targeted at rendering attribute views and database rows, the filter fails to verify whether the requested resource requires a password or if a valid password has been supplied by the client.\nThe attack flow proceeds as follows: an unauthenticated remote attacker initiates an HTTP request directly to the application endpoint invoking the renderAttributeView function.\nDue to the flawed validation logic in FilterViewByPublishAccess, the application bypasses the authentication and password verification checks entirely.\nThe backend subsequently processes the request and returns the requested sensitive document rows, including internal block IDs, titles, and underlying column values, directly to the unauthenticated user.\nAffected software versions include all iterations of SiYuan prior to v3.7.4.\nNo authentication requirements or user-supplied credentials are needed to successfully execute this payload, lowering the exploitation threshold.\nThe network exposure is global to any interface hosting the vulnerable SiYuan publishing mechanism.\nThe post-exploitation impact is strictly confined to unauthorized information disclosure, enabling unauthenticated readers to extract confidential data from password-protected document views."
}