Unauthorized Access in SiYuan Knowledge Management System
CVE-2026-54068

5.9MEDIUM

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
24 June 2026

What is CVE-2026-54068?

SiYuan, an open-source personal knowledge management system, has a vulnerability that allows unauthorized access to sensitive user data. Prior to version 3.7.0, the /api/icon/getDynamicIcon endpoint lacks authentication, enabling network-adjacent attackers to exploit it. By providing a valid block ID and a specific type parameter, attackers can execute arbitrary SQL queries against the SQLite database used by SiYuan. This can lead to the unauthorized extraction of user notes, tags, and other essential content, underscoring the importance of securing API endpoints.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.