GO-2026-6388 SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode) in github.com/siyuan-note/siyuan/kernel

🗓️ 10 Sep 2026 14:48:42Reported by GoogleType

osv🔗 osv.dev👁 3 Views

SiYuan publish filter omits password tier, letting readers access protected rows without password.

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2026-72806	12 Aug 202619:07	–	attackerkb
Circl	CVE-2026-72806	4 Sep 202600:35	–	circl
CVE	CVE-2026-72806	12 Aug 202619:07	–	cve
Cvelist	CVE-2026-72806 SiYuan before v3.7.4 Authentication Bypass via Attribute View	12 Aug 202619:07	–	cvelist
EUVD	EUVD-2026-57466	3 Sep 202622:50	–	euvd
Github Security Blog	SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)	3 Sep 202622:50	–	github
Github Security Blog	Duplicate Advisory: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)	12 Aug 202621:31	–	github
NVD	CVE-2026-72806	12 Aug 202620:17	–	nvd
OSV	GHSA-6MCF-G667-W3QV SiYuan: Password (protected) tier omitted in the attribute-view/database publish filter: Reader receives rows of protected documents without the password (publish mode)	3 Sep 202622:50	–	osv
Positive Technologies	PT-2026-71248	12 Aug 202600:00	–	ptsecurity

Source	Link
github	www.github.com/siyuan-note/siyuan/security/advisories/GHSA-6mcf-g667-w3qv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-72806
github	www.github.com/siyuan-note/siyuan/commit/768427f20f13bbd8dc4effa8aa4e1d09a7741bf4
vulncheck	www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-attribute-view

10 Sep 2026 15:15Current

CVSS 3.15.8

CVSS 46.9

EPSS0.00307

SSVC

SiYuan publish filter information disclosure protected documents attribute view access control