Vulnerability GO-2026-6632
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
23 days ago
October 07, 2026 at 02:09 PM UTC
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
>=0.0.0-20260726161145-9b8e8956f997 <0.0.0-20260812083335-251596fc0de2
>=0.0.0-20260726161145-9b8e8956f997 <0.0.0-20260812083335-251596fc0de2
Summary
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
Details
SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 days ago
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
<0.0.0-20260808051406-3542530c505f GHSA-c8r8-95hg-mp34
<0.0.0-20260808051406-3542530c505f GHSA-c8r8-95hg-mp34
Medium Risk
7 days ago
SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin
<0.0.0-20260808010544-26ccb40d390e GHSA-rpx2-p6hp-x5gj
<0.0.0-20260808010544-26ccb40d390e GHSA-rpx2-p6hp-x5gj
High Risk
7 days ago
SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream
<0.0.0-20260731131820-67bc300b6ea6 GHSA-c8w8-3pqp-wr83
<0.0.0-20260731131820-67bc300b6ea6 GHSA-c8w8-3pqp-wr83
Medium Risk
7 days ago
SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden
<0.0.0-20260731093152-c7522b8db586 GHSA-4pjg-x8qj-33j5
<0.0.0-20260731093152-c7522b8db586 GHSA-4pjg-x8qj-33j5
Medium Risk
7 days ago
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
<0.0.0-20260730150429-5b42614311b0 GHSA-p4qw-vx5p-g984
<0.0.0-20260730150429-5b42614311b0 GHSA-p4qw-vx5p-g984
Impacted packages
Timeline
Published
23 days ago
October 07, 2026 at 02:09 PM UTC
Fixed (v0.0.0-20260812083335-251596fc0de2)
2 months ago
August 12, 2026 at 08:33 AM UTC
Last Modified
16 hours ago
October 30, 2026 at 10:55 AM UTC