Description
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.
Published: 2026-09-09
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An incomplete remediation of a prior SQL injection flaw allows an authenticated administrator on a workspace running in read‑only mode to send crafted SQL to the /api/search/fullTextSearchBlock endpoint, bypassing the application’s read‑only boundary and gaining unrestricted read access to the blocks database. The vulnerability enables confidential data disclosure beyond the intended read‑only restriction and is classified as CWE‑693, a system or application takeover.

Affected Systems

SiYuan Note’s SiYuan application for all released versions up to 3.8.1 is affected by this flaw. The issue is addressed in version 3.8.2 and later.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severity risk. While the EPSS score is not available, the lack of a CISA KEV listing does not diminish the potential impact. Exploitation is feasible only by users with administrator privileges on a read‑only workspace, making it a privilege‑escalation scenario that can be executed via the exposed POST endpoint with no additional external conditions.

Generated by OpenCVE AI on September 9, 2026 at 12:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade SiYuan to version 3.8.2 or later to apply the official fix.
  • Reduce administrator privileges on workspaces that run in read‑only mode or remove those users entirely.
  • Block or rate‑limit the /api/search/fullTextSearchBlock endpoint for read‑only workspaces through a firewall or reverse proxy to prevent bypass attempts.

Generated by OpenCVE AI on September 9, 2026 at 12:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 09 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.
Title SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
First Time appeared B3log
B3log siyuan
Weaknesses CWE-693
CPEs cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*
Vendors & Products B3log
B3log siyuan
References
Metrics cvssV3_1

{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

B3log Siyuan
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-09T14:05:19.500Z

Reserved: 2026-09-09T10:30:15.669Z

Link: CVE-2026-87808

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-09T12:17:15.503

Modified: 2026-09-09T12:17:15.503

Link: CVE-2026-87808

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T12:30:09Z

Weaknesses
  • CWE-693

    Protection Mechanism Failure