Is CVE-2026-82651 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82651 being exploited in the wild.

How severe is CVE-2026-82651?

Medium severity, with a CVSS score of 4.9, published 30 August 2026.

Which products and versions are affected?

github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260816034002-035bf9a8c311; SiYuan before 3.8.1.

Is there a fix for CVE-2026-82651?

Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260816034002-035bf9a8c311 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82651 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-82651?

Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82651: SiYuan missing authorization in history and repo diff endpoints

CVE-2026-82651 · Severity: medium · CVSS 4.9 · Published 2026-08-30

SiYuan is a personal knowledge management application with note-taking and publishing capabilities. An authenticated administrator can bypass a security guard designed to block access to sensitive files (including plaintext publish passwords and template files) by accessing historical snapshots through the /history and /repo/diff endpoints, potentially exposing credentials and configuration data that should be protected.

Technologies: github.com/siyuan-note/siyuan/kernel (Go), SiYuan. Vendors: Go, SiYuan.

Quick answers

Is CVE-2026-82651 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82651 being exploited in the wild.
How severe is CVE-2026-82651?: Medium severity, with a CVSS score of 4.9, published 30 August 2026.
Which products and versions are affected?: github.com/siyuan-note/siyuan/kernel (Go) SEMVER:introduced=0,fixed=0.0.0-20260816034002-035bf9a8c311; SiYuan before 3.8.1.
Is there a fix for CVE-2026-82651?: Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260816034002-035bf9a8c311 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82651 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82651?: Check whether you run github.com/siyuan-note/siyuan/kernel (Go) or SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260816034002-035bf9a8c311 or later
```
go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260816034002-035bf9a8c311
```

Technical details

The vulnerability is a missing authorization check (CWE-862/CWE-200) in two HTTP endpoints: /history/*path and /repo/diff/*path in kernel/server/serve.go. While these endpoints require admin authentication and were meant to be protected by the IsForbiddenAbsPath guard (introduced in a prior advisory GHSA-c8r8-95hg-mp34), they construct file paths independently without calling this guard. An authenticated admin attacker can retrieve historical or diff-view copies of sensitive files such as data/.siyuan/publishAccess.json (containing plaintext publish-mode passwords) and files under data/templates/ that exist in the repository history or diff-checkout directory. The guard successfully protects live file access endpoints but fails to cover these archive/history endpoints. The vulnerability requires admin-level authentication and network access to the affected SiYuan instance (typically port 6806). Patched in version 3.8.1.

Affected products

SiYuan SiYuan before 3.8.1

Identifiers

CVE-2026-82651
GHSA-3cm4-ccvw-6xr6
GO-2026-6662

Timeline

2026-08-30: disclosed
2026-08-30: patched: patched in v3.8.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.