Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)

The `/api/av/getAttributeViewSearchTarget` endpoint in SiYuan's development branch is registered with `CheckAuth` only and performs no authorization checks of any kind - no `CheckReadonly`, no publish-access gate, and no encrypted-notebook check. An anonymous reader who obtains a database block identifier from a published page they may legitimately view can query this endpoint with a keyword and receive matching row content, including rows that `FilterAttributeViewByPublishAccess` would otherwise strip from their view. This allows unauthorized retrieval of database row content that publish filters are intended to withhold. Affected versions: - development branch, introduced by 9b8e8956f - not present in v3.7.3 or on master We recommend updating to: v3.7.4. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9cqf-hhrq-7v45 Details: https://vuln.today/cve/CVE-2026-73608