CVE-2026-72806

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description An authentication bypass exists in the FilterViewByPublishAccess filter. The system fails to verify publish password protection when rendering attribute views and database rows. This allows unauthenticated readers to access password-protected document rows, including titles, block IDs, and column values, by calling the renderAttributeView() function without providing the necessary password.

Recommendations Update SiYuan to version 3.7.4 or later. As a temporary mitigation, restrict access to the renderAttributeView() function.