The vulnerability allows any authenticated user, including those with reader-level permissions, to execute arbitrary SQL statements against the SiYuan database via the /api/query/sql endpoint. Because the endpoint checks only for basic authentication and does not verify admin status, users can read or modify all data stored in the database. This can lead to data theft, corruption, or unauthorized configuration changes, thereby compromising confidentiality, integrity, and potentially availability. The problem is rooted in missing permission checks (CWE-862) and is exploitable as a SQL injection (CWE-89).

SiYuan, a personal knowledge‑management system, is affected. The issue exists in all releases prior to version 3.6.0. Any installation of Siyuan before that version that retains the vulnerable /api/query/sql endpoint is susceptible.

The CVSS score is 5.7, indicating a medium severity. EPSS indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the exposed HTTP API; any authenticated user can invoke the endpoint remotely, bypassing role checks. Because the flaw permits arbitrary SQL execution, an attacker can gain unauthorized access to all database contents. Remediation with the latest patch eliminates the risk.