Executive brief
SiYuan, a personal knowledge management system, contains a vulnerability where certain internal functions are not properly restricted to administrators. This allows regular visitors or guest users to modify server configurations, change synchronization settings, and alter search results. An attacker could use this to disrupt service availability, manipulate the user interface, or gain unauthorized insights into private document history.
Technical details
The vulnerability exists in the SiYuan kernel's router configuration where eight API endpoints (including /api/graph/getGraph, /api/sync/setSyncInterval, and /api/search/updateEmbedBlock) are registered with 'model.CheckAuth' but lack 'model.CheckAdminRole' and 'model.CheckReadonly' guards. This allows any authenticated user, including anonymous visitors in publish-mode (RoleReader), to perform state-changing operations. Attackers can trigger atomic rewrites of the workspace configuration file (conf.json), manipulate the SQL 'blocks' table to poison search results, and modify recent document history. The root cause is an authorization bypass due to insufficient middleware gating on sensitive POST handlers. A patch is available in the latest repository commits which adds the missing role checks.
Affected products
- siyuan-note SiYuan <= 3.6.5
Timeline
- 2026-05-10: advisory: Initial GitHub Advisory published
- 2026-05-12: patched: Fix committed to repository
- 2026-05-13: disclosed: CVE-2026-45371 assigned and advisory updated