A flaw in the publish service allows low‑privilege users with the RoleReader role to append new blocks to existing notebooks through the /api/block/appendHeadingChildren endpoint. The endpoint only verifies a generic authenticated session and does not check for higher privileges such as Admin or Read‑Only. As a result, authenticated users can modify the content of notes, providing a privilege escalation route that undermines the integrity of stored data.

The vulnerability affects the SiYuan Note application, specifically versions prior to 3.5.10. Users of older releases who have assigned the Publish role with read‑only privileges are at risk.

The CVSS score is 7.1, indicating a medium severity vulnerability. The EPSS score is below 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated via a publish account and possess the RoleReader role; they can then use the vulnerable API endpoint to inject or modify notebook blocks. Because the exploit requires only low‑privilege credentials, the risk is significant for any user who has been granted publish access.