Privilege Escalation in SiYuan Knowledge Management System

CVE-2026-30926

What is CVE-2026-30926?

SiYuan Note, a personal knowledge management system, has a vulnerable API endpoint that allows low-privilege users (RoleReader) to modify notebook content without the necessary permissions. Prior to version 3.5.10, the /api/block/appendHeadingChildren endpoint only checks for a basic role (model.CheckAuth), enabling authenticated users with read-only permissions to append content to existing documents. This flaw compromises the integrity of notes by allowing unauthorized alterations, presenting a significant security risk for users.

References