CVE-2026-72798

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An issue exists in the renderAttributeView function where related-database content is not properly filtered. This allows anonymous readers or users with RoleReader permissions to access sensitive information from Relation and Rollup cells belonging to databases that are hidden, password-protected, or forbidden from publishing. This occurs because the accessibility check in FilterViewByPublishAccess only evaluates the first cell of a row and ignores the remaining cells, which may contain mirrored content from restricted databases.

Additionally, a fail-open condition exists where the accessibility check is skipped entirely if the first column of a database is a non-block type (such as Text or Relation) or if the row is detached. Since column order is user-reorderable, this can lead to the complete bypass of row filtering.

Technical details include:

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, avoid using Relation or Rollup columns in databases that are published if they link to restricted or private databases. Ensure that the first column of any published database is a block type to prevent the fail-open row filtering bypass.