SiYuan exposes the \/api\/tag\/getTag endpoint without enforcing Admin or Read‑Only checks, allowing any authenticated user to post a sort parameter. The handler writes the Conf.Tag.Sort value to the workspace’s conf.json file, which means an attacker can persist configuration changes without elevated rights. This flaw is a classic example of missing access control (CWE‑285) and improper authorization checks (CWE‑862), but it does not provide remote code execution or system compromise.

SiYuan, an open‑source personal knowledge management system, is affected in all versions prior to 3.7.0. Any installation that has not applied the 3.7.0 release or later, or that has users with Reader or read‑only Editor roles, is vulnerable. No publicly disclosed exploitation exists yet, but the flaw can be used by legitimate users with limited privileges to alter application behavior.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication but no higher privileges; an attacker with a Reader or read‑only role can send a crafted POST request to mutate the configuration. Once the configuration is altered, the change is immediately persisted to disk and will affect all users of the workspace.