{"id":"GHSA-5fhr-f75j-8wr9","summary":"SiYuan: Missing publish-access filter on getAttributeViewKeysByID discloses database column schema, plus two unscoped block-ID enumeration oracles (publish mode)","details":"**CVE:** This vulnerability corresponds to [CVE-2026-72800](https://nvd.nist.gov/vuln/detail/CVE-2026-72800).\n\n### Summary\n\n`POST /api/av/getAttributeViewKeysByID` returns a database's full column schema with no publish-access filtering, while its sibling `getAttributeViewKeys` applies the filter for reader sessions. Two further endpoints, `getBlockDefIDsByRefText` and `getBlockRelevantIDs` return workspace-wide block IDs with no publish scoping. All three are `CheckAuth`-only, so they are reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`.\n\n### Details\n\n**(a) `getAttributeViewKeysByID`: ungated column-schema disclosure**\n\nThe entire handler (`kernel/api/av.go`, router line 548):\n```go\nret.Data = model.GetAttributeViewKeysByID(avID, keyIDs...)   // no publish gate\n```\n\nWith an empty `keyIDs`, `GetAttributeViewKeysByID` calls `av.ParseAttributeView(avID)` and returns every column's `*av.Key`:\n\n| Field | Discloses |\n|---|---|\n| `Name`, `Desc` | column title and user-authored description |\n| `Options` | the full single/multi-select vocabulary and colours (e.g. status labels such as \"Fired\", \"Confidential\") |\n| `Template` | the column's Sprig template expression — logic and field references |\n| `Relation` | the target `avID`, allowing pivot to another database |\n| `Rollup`, `NumberFormat`, date config | further schema |\n\n**Guarded-sibling asymmetry, same file:** `getAttributeViewKeys` (router line 526) runs `FilterBlockAttributeViewKeysByPublishAccess(...)` when `IsReadOnlyRoleContext`. `getAttributeViewKeysByID` applies nothing. A reader who knows an `avID` — trivially harvested from the `data-av-id` attribute of any published document embedding a database obtains the schema of any database in the workspace, including those whose host documents are hidden, password-protected, or publish-forbidden. `Relation` targets allow walking to sibling databases.\n\n**(b) Two unscoped block-ID enumeration oracles**\n\nBoth `CheckAuth`-only with no publish gate. Neither returns content of its own, but both yield valid block IDs that other endpoints turn into content:\n\n- `getBlockDefIDsByRefText` (router line 237) → `GetBlockDefIDsByRefText(anchor)` returns the block IDs, workspace-wide and including private documents, whose reference/anchor text equals a caller-supplied string: a ref-text → ID oracle.\n- `getBlockRelevantIDs` (router line 274) → `GetBlockRelevantIDsInBox(id, \u003cnotebook from request\u003e)` returns parent/previous/next block IDs and traverses decrypted encrypted-notebook structure while the notebook is unlocked, a tree-walk oracle.\n\nVerified at `origin/master` (`eef105683`): all three handler bodies contain no publish-access, publish-ignore, or readonly-role check; all three routes are registered `CheckAuth` without `CheckAdminRole`.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. A database exists whose host document is publish-forbidden or password-protected.\n\n**(a) Column schema of any database:**\n```\nPOST http://127.0.0.1:6808/api/av/getAttributeViewKeysByID\n{\"avID\":\"\u003cAV_ID\u003e\"}\n```\nReturns every column's key object names, descriptions, select vocabularies, template expressions, and `Relation` target `avID`s for a database whose host document the reader may not access.\n\n**Control:** the sibling `getAttributeViewKeys` with the same `avID` returns filtered results for the same reader session, confirming the boundary is enforced there and omitted here.\n\n**(b) ID oracles:**\n```\nPOST http://127.0.0.1:6808/api/block/getBlockDefIDsByRefText\n{\"anchor\":\"\u003cknown ref text\u003e\"}\n→ block IDs workspace-wide, including blocks in private documents\n\nPOST http://127.0.0.1:6808/api/block/getBlockRelevantIDs\n{\"id\":\"\u003cBLOCK_ID\u003e\",\"notebook\":\"\u003cBOX_ID\u003e\"}\n→ parent/previous/next block IDs; traverses encrypted-notebook structure when unlocked\n```\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can read the complete column schema of any database in the workspace, including column descriptions, select-option vocabularies (which frequently encode sensitive category labels), template logic, and relation targets that permit pivoting to further databases regardless of whether the host document is hidden, password-protected, or excluded from publishing.\n\nThe two enumeration endpoints additionally supply valid block IDs across the publish boundary, including from encrypted notebooks while unlocked. This removes the \"attacker must already know a valid ID\" precondition from other block-read endpoints, converting ID knowledge into content disclosure. Confidentiality-only.\n\n### Note\n\ngetAttributeViewKeysByID is a distinct handler from getAttributeView; although column definitions also appear within the latter's response payload, a fix applied to one handler does not remediate the other, and getAttributeViewKeysByID has its own filtered sibling (getAttributeViewKeys) demonstrating the intended treatment.\n\n### Suggested fix\n\n- Gate `getAttributeViewKeysByID` with `FilterBlockAttributeViewKeysByPublishAccess`, mirroring `getAttributeViewKeys`.\n- Scope `getBlockDefIDsByRefText` and `getBlockRelevantIDs` to publish-accessible blocks for reader sessions, and ensure the `*InBox` traversal path applies the same check before walking encrypted-notebook structure.","aliases":["CVE-2026-72800","GO-2026-6395"],"modified":"2026-09-10T15:25:49.896754076Z","published":"2026-09-03T23:04:13Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-09-03T23:04:13Z","nvd_published_at":null,"cwe_ids":["CWE-862"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5fhr-f75j-8wr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72800"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/commit/931ba693375ea9877b2ef74f9bfb632fad5bab3f"},{"type":"WEB","url":"https://github.com/siyuan-note/siyuan/commit/f36331956ae98fc5358f8f93bf1da3427221edf3"},{"type":"PACKAGE","url":"https://github.com/siyuan-note/siyuan"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-unfiltered-api"}],"affected":[{"package":{"name":"github.com/siyuan-note/siyuan/kernel","ecosystem":"Go","purl":"pkg:golang/github.com/siyuan-note/siyuan/kernel"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260724103335-f36331956ae9"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5fhr-f75j-8wr9/GHSA-5fhr-f75j-8wr9.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}