THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-mfrj-v65r-979c (high) — SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

[GHSA] GHSA-mfrj-v65r-979c (high) — SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

highgithub_advisoriesPublished 2026-09-04

GHSA-mfrj-v65r-979c Severity: high CVE: CVE-2026-72798

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

**CVE:** This vulnerability corresponds to CVE-2026-72798.

### Summary

`renderAttributeView` correctly applies the reader publish-access filter, but the

Indicators of compromise

CVE-2026-72798cve
http://127.0.0.1:6808/api/av/renderAttributeViewurl

Original source: https://github.com/advisories/GHSA-mfrj-v65r-979c