CVE-2026-45147: SiYuan missing authorization in tag API configuration write

Executive brief

SiYuan, a personal knowledge management system, contains a flaw where users with low-level 'Reader' permissions can modify server configuration settings. Specifically, an attacker can change how tags are sorted, which triggers a rewrite of the entire system configuration file. While the direct impact is limited to display settings, this bypasses intended security boundaries and could lead to accidental data loss if multiple users attempt to change settings at the same time.

Technical details

The `/api/tag/getTag` endpoint in SiYuan's kernel is registered with only `model.CheckAuth`, missing the `model.CheckAdminRole` and `model.CheckReadonly` middleware used by other administrative endpoints. The handler for this endpoint contains logic that, if a `sort` parameter is provided, updates the global `model.Conf.Tag.Sort` value and calls `model.Conf.Save()`. This allows any authenticated user, including those with `RoleReader` or `RoleEditor` (on read-only workspaces), to trigger an atomic rewrite of the workspace's `conf.json`. This creates a risk of unauthorized state mutation and potential race conditions (TOCTOU) that could revert unrelated configuration changes made by legitimate administrators.

Affected products

• siyuan-note SiYuan < 0.0.0-20260512140701-d7b77d945e0d

Timeline

• 2026-05-08: disclosed: Initial disclosure to vendor
• 2026-05-13: advisory: GitHub Advisory published

References

• https://api.github.com/users/StarPlatinu
• https://github.com/StarPlatinu
• https://api.github.com/users/StarPlatinu/gists%7B/gist_id%7D
• https://api.github.com/users/StarPlatinu/repos
• https://avatars.githubusercontent.com/u/72287279?v=4
• https://api.github.com/users/StarPlatinu/events%7B/privacy%7D