CVE-2026-73049

CVE-2026-73049 is a classic access control logic inversion in SiYuan's backlink resolution endpoint. The bug isn't a missing authorization check—it's the wrong authorization check. The endpoint `getAttributeViewBacklinks` filters backlinks using a "forbidden" list when it should filter using a "visibility" list. The developer understood backlinks needed access control, but conflated two conceptually distinct exclusion lists under cognitive load, and the error survived because hidden documents are—by definition—enumerated by neither testers nor the system's own discovery tooling. The practical impact is more serious than the CVSS 5.8 suggests. SiYuan users deliberately hide sensitive documents (financial records, journals, strategic plans) under a hidden tier they trust. This vulnerability reveals whether hidden documents exist and exposes their paths—a targeted recon capability against precisely the users who believed they'd protected sensitive content. That's a trust violation the CVSS metric doesn't capture. More concerning is the blast radius. This error pattern—substituting a forbidden list for a visibility list in filtering logic—has a documented genealogy in CMS and wiki systems going back two decades. The pattern recurs because forbidden and visibility lists often start equivalent during initial implementation and diverge later when permission models gain nuance. That divergence is invisible until someone queries state the old way. The regression hypothesis (lists diverged during a refactor and this call site was missed) is structurally identical to CVE-2013-2763 and similar failures in major platforms from 2018-2021. For defenders: audit your codebase for other endpoints that query hidden-state using permission lists. Check whether any code path assumes forbidden and visibility are interchangeable. The fix to this endpoint is trivial; the broader audit to find equivalent conflations is not. If you're running a shared-hosting deployment with anonymous readers, one actor can script enumeration of hidden document topology across all users—this becomes a scalable recon tool, not just individual disclosure.

Reviewed through automated stages and approved by a human before publication.