## Summary
SiYuan versions before v3.7.4 expose block-level content and reference/backlink topology for password-protected documents via the getGraph and getLocalGraph endpoints. The issue is due to missing publish-password validation in the graph filtering logic, allowing anonymous readers to retrieve protected content without supplying a password.
## Technical Details
- Affected handlers: getGraph and getLocalGraph.
- Both endpoints are described as CheckAuth-only and reachable by the anonymous account when Publish.Auth.Enable is false.
- Root cause in graph filtering:
- The graph code filters nodes/links using only the visibility tier (commented as “Visible tier ONLY”): model.GetInvisiblePublishAccess(...) and model.FilterGraphByPublishIgnore(...).
- FilterGraphByPublishIgnore calls CheckPathAccessableByPublishIgnore(node.Box, node.Path, publishIgnore) and performs no password evaluation (graph code search indicates no CheckPublishAuthCookie or password checks).
- Password-protected documents are treated as Visible = true, so their nodes are not dropped by the filter.
- Data exposure mechanism:
- Surviving graph nodes represent blocks and carry actual content.
- genTreeNodes emits one node per block and nodeTitleLabel sets node.Title = node.Label = block.Content (so the graph returns per-block text, not just titles).
## Affected
- SiYuan versions: >= 0 and < 3.7.4.
## Impact
- Sensitive information disclosure: anonymous readers can retrieve per-block content of password-protected documents.
- Topology disclosure: attackers can also obtain the complete reference/backlink graph for those documents.
- Attack prerequisites (from reference): publish.
## Mitigation
1. Upgrade SiYuan to v3.7.4 or later (issue affects versions before v3.7.4).
2. Ensure Publish.Auth.Enable is enabled so anonymous access to these endpoints is prevented.
3. Monitor for access to the graph endpoints (getGraph, getLocalGraph) from anonymous sessions and alert on unexpected graph retrieval activity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CWE-200