{"id":"GHSA-9cqf-hhrq-7v45","kind":"vulnerability","aliases":["GHSA-9cqf-hhrq-7v45","GO-2026-6632"],"related":[],"title":"SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel","description":"SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route in github.com/siyuan-note/siyuan/kernel","summary":"SiYuan's getAttributeViewSearchTarget endpoint in the kernel Go module returns database row content to anonymous readers because it skips the publish-access check. An unauthenticated visitor of a published SiYuan instance can read database content that should be private.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/siyuan-note/siyuan/kernel","fixed":["0.0.0-20260812083335-251596fc0de2"],"affected":">= 0.0.0-20260726161145-9b8e8956f997, < 0.0.0-20260812083335-251596fc0de2","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","package","self-hosted","siyuan"],"not_affected_if":["fixed-version","unpublished-instance"],"how_to_check":null,"fix":"Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260812083335-251596fc0de2 or later.","status":"open","published_at":"2026-10-07T14:09:59+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:20:13+00:00","updated_at":"2026-10-23T20:20:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:20:13Z","model":"claude-haiku-5-5","output":{"fix":"Update github.com/siyuan-note/siyuan/kernel to version 0.0.0-20260812083335-251596fc0de2 or later.\nunknown","summary":"SiYuan's getAttributeViewSearchTarget endpoint in the kernel Go module returns database row content to anonymous readers because it skips the publish-access check. An unauthenticated visitor of a published SiYuan instance can read database content that should be private.","category":"package","who_cares":["go","siyuan","self-hosted"],"confidence":0.6,"analyst_note":"Sources give only the affected and fixed pseudo-versions; check https://pkg.go.dev/vuln/GO-2026-6632 and the GHSA advisory for severity, exposure conditions and a way to detect the vulnerable route.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unpublished-instance","fixed-version"],"severity_if_unknown":"unknown"},"cost_usd":0.000379,"input_tokens":2142,"output_tokens":329,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':37A '-6632':38A '/siyuan-note/siyuan/kernel':30A,46A,122C '7v45':35A,43A '9cqf':33A,41A 'access':14A,75B,106C 'adjac':25A,117C 'anonym':8A,67B,100C 'check':15A,76B,107C 'class':18A,110C 'close':19A,111C 'content':6A,65B,88B,98C 'databas':4A,63B,87B,96C 'day':21A,113C 'earlier':22A,114C 'endpoint':56B 'getattributeviewsearchtarget':2A,55B,94C 'ghsa':32A,40A 'ghsa-9cqf-hhrq-7v45':31A,39A 'github.com':29A,45A,121C 'github.com/siyuan-note/siyuan/kernel':28A,44A,120C 'go':36A,47B,60B 'hhrq':34A,42A 'host':51B 'instanc':84B 'kernel':59B 'modul':61B 'one':20A,112C 'packag':48B 'privat':92B 'publish':13A,74B,82B,105C 'publish-access':12A,73B,104C 'read':86B 'reader':9A,68B,101C 'reopen':16A,108C 'return':3A,62B,95C 'rout':26A,118C 'row':5A,64B,97C 'self':50B 'self-host':49B 'siyuan':1A,52B,53B,83B,93C 'skip':71B 'unauthent':78B 'visitor':79B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-07T14:09:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6632","url":"https://pkg.go.dev/vuln/GO-2026-6632","severity":null,"published_at":"2026-10-07T14:09:59+00:00","modified_at":"2026-10-07T14:09:59+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}