CVE-2026-72799: SiYuan Missing Publish-access Filter On The Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5w7r-f4cg-rqq7",
  "modified" : "2026-09-04T20:53:34Z",
  "published" : "2026-09-04T20:53:34Z",
  "aliases" : [ "CVE-2026-72799" ],
  "summary" : "SiYuan: Missing publish-access filter on the HPath/path-resolution endpoints discloses the private document tree to anonymous readers",
  "details" : "**CVE:** This vulnerability corresponds to [CVE-2026-72799](https://nvd.nist.gov/vuln/detail/CVE-2026-72799).\n\n### Summary\n\nFive filetree endpoints resolve arbitrary document IDs and paths with no publish-access check of any kind. All are `CheckAuth`-only, so they are reachable by the publish `RoleReader` token and by the anonymous account when `Publish.Auth.Enable` is `false`. An anonymous reader can map the complete private document tree every notebook, folder, and document title, and which notebook holds each document for documents marked hidden, password-protected, or publish-forbidden, and can resolve titles to document IDs.\n\n### Details\n\nNone of the following handlers invokes `IsReadOnlyRoleContext`, `CheckBlockIdAccessableByPublishAccess`, or `CheckPathAccessableByPublishIgnore`:\n\n| Endpoint | Returns | Discloses |\n|---|---|---|\n| `getFullHPathByID` (router 159) | `GetFullHPathByID(id)` | full title path including notebook, e.g. `/MySecretNotebook/Confidential/Q3 Layoffs Plan` |\n| `getHPathByID` (router 157) | `GetHPathByID(id)` | document-relative title path |\n| `getPathByID` (router 158) | `{path, notebook}` | which notebook a document lives in, plus its `.sy` storage path |\n| `getIDsByHPath` (router 160) | `GetIDsByHPath(path, notebook)` | title-path → document-ID enumeration |\n| `getHPathByPath` (router 155) | HPath from a storage path | title path from a storage path |\n\nEach accepts an arbitrary ID or HPath and resolves it identically for hidden, publish-forbidden, and password-protected documents.\n\nThis enables two operations for an unauthenticated caller:\n1. **Map the private document tree**: `getFullHPathByID` and `getPathByID` yield every notebook/folder/document title and its containing notebook.\n2. **Resolve titles to IDs**: `getIDsByHPath` converts a known or guessed title path into document IDs, which are the required input for other block-read endpoints.\n\nDocument titles and HPaths are precisely the block metadata that the project's block-metadata restriction (commit `ffde3b21e`) set out to protect; that change gated `getBlockInfo`, `getDocInfo`, and `getDocsInfo` but left this entire path-resolution family open.\n\n**Guarded-sibling asymmetry.** `getRecentDocs` (`FilterRecentDocsByPublishAccess`), `getCriteria` (`FilterCriteriaByPublishAccess`), and `getLocalStorage` (`FilterLocalStorageByPublishAccess`) all filter document references for reader sessions. The codebase clearly publish-scopes reader-visible metadata elsewhere; these five endpoints do not.\n\nVerified at `origin/master` (`eef105683`): all five handler bodies contain no publish-access call; the storage-family siblings contain their filters; all five routes are registered `CheckAuth` without `CheckAdminRole`.\n\n### Proof of Concept\n\nPrecondition: publish mode enabled (default port 6808); anonymous when `Publish.Auth.Enable` is `false`, otherwise any publish reader account. A document exists in a notebook marked publish-forbidden or password-protected.\n\n**Resolve a private document's full title path:**\n```\nPOST http://127.0.0.1:6808/api/filetree/getFullHPathByID\n{\"id\":\"<DOC_ID>\"}\n→ /MySecretNotebook/Confidential/Q3 Layoffs Plan\n```\n\n**Identify its notebook and storage path:**\n```\nPOST http://127.0.0.1:6808/api/filetree/getPathByID\n{\"id\":\"<DOC_ID>\"}\n→ {\"path\":\"/....sy\",\"notebook\":\"<BOX_ID>\"}\n```\n\n**Enumerate IDs from a title path:**\n```\nPOST http://127.0.0.1:6808/api/filetree/getIDsByHPath\n{\"path\":\"/Confidential\",\"notebook\":\"<BOX_ID>\"}\n→ document IDs under a folder the reader cannot otherwise access\n```\n\nEach returns data for documents excluded from publishing; no password or membership is required.\n\n### Impact\n\nAn anonymous reader (publish mode with auth disabled) or any publish `RoleReader` can enumerate the complete private document structure: notebook names, folder hierarchy, and document titles for content the administrator marked hidden, password-protected, or excluded from publishing. Document titles alone are frequently sensitive (project names, personnel actions, client identifiers). The ID-resolution direction additionally supplies valid document IDs, removing the \"attacker must know an ID\" precondition for other block-read endpoints. Confidentiality-only.\n\n### Suggested fix\n\nFor `IsReadOnlyRoleContext` sessions, gate each of the five handlers with `CheckBlockIdAccessableByPublishAccess` (or restrict resolution to publish-visible documents), mirroring the treatment already applied in `getRecentDocs`, `getCriteria`, and `getLocalStorage`.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/siyuan-note/siyuan/kernel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20260724112156-5bae0926b896"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-5w7r-f4cg-rqq7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-72799"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/siyuan-note/siyuan/commit/5bae0926b896eaff0bc5cc6a75d421c2d161a806"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/siyuan-note/siyuan"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-path-resolution"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-04T20:53:34Z",
    "nvd_published_at" : null
  }
}