Information disclosure in SiYuan publish-mode attribute view filter (CVE-2026-72798)

Two defects in SiYuan's `renderAttributeView` publish-access filter allow anonymous readers to retrieve restricted content in publish mode. First, Relation and Rollup cells carry mirrored content from related databases that may be hidden, publish-forbidden, or password-protected, and no publish-access check is applied to that mirrored content. Second, when the first column of a database is not a block type, the row-level accessibility check is skipped entirely and the row is returned to the anonymous reader unchecked. Affected versions: - <=v3.7.2 We recommend updating to: v3.7.4. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-mfrj-v65r-979c Details: https://vuln.today/cve/CVE-2026-72798