Authorization Bypass Vulnerability in SiYuan Personal Knowledge Management System

CVE-2026-32767

What is CVE-2026-32767?

SiYuan, a personal knowledge management system, is susceptible to an authorization bypass flaw in the /api/search/fullTextSearchBlock endpoint for versions 3.6.0 and earlier. This vulnerability allows authenticated users, including those with limited Reader roles, to execute arbitrary SQL commands against the SQLite database without proper authorization checks. Specifically, when the method parameter is set to 2, user input is directly passed to the database as an unfiltered SQL statement. This serious inconsistency undermines the security model, as the dedicated SQL endpoint rightly enforces both CheckAdminRole and CheckReadonly middleware. This critical issue has been resolved in version 3.6.1.

References