CVE-2026-32767 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-32767 requires immediate attention.

· 3 min read

```html

Executive Summary

A critical authorization bypass vulnerability (CVE-2026-32767) has been identified in SiYuan Note v3.6.0 and likely prior versions. This vulnerability allows any authenticated user, including those with the Reader role, to execute arbitrary SQL statements against the application's database through the `/api/search/fullTextSearchBlock` endpoint. This poses significant risks to data confidentiality, integrity, and availability.

Immediate Action

  • Immediately restrict access to the vulnerable endpoint by implementing network-level controls.
  • Upgrade to the patched version of SiYuan Note as soon as it is available (check vendor advisories for updates).
  • Review and restrict user roles and permissions, ensuring that only trusted users have access to sensitive functionalities.
  • Isolate the service from public exposure if possible, especially in multi-user environments.
  • Monitor logs for any unauthorized access attempts or unusual database activity.

Affected Versions

  • go github.com/siyuan-note/siyuan/kernel@<=3.6.0 vulnerable; upgrade to 3.6.1+

Resolution Guide

To mitigate this vulnerability, follow these steps:

Upgrade Instructions

For Go-based projects, run:

go get github.com/siyuan-note/siyuan/kernel@3.6.1

Configuration Hardening

Consider adding role checks to the vulnerable endpoint. Modify the `fullTextSearchBlock` function as follows:

if method == 2 && !model.IsAdminRoleContext(c) {
    ret.Code = -1
    ret.Msg = "SQL search requires administrator privileges"
    return
}

Detection & Verification

To check if your version is vulnerable, run:

go list -m all | grep siyuan-note/siyuan

To verify the fix, attempt to execute a SQL command as a Reader role user and ensure it is blocked:

curl -X POST http://:6806/api/search/fullTextSearchBlock \
  -H "Content-Type: application/json" \
  -H "Authorization: Token " \
  -d '{"method": 2, "query": "SELECT * FROM blocks"}'

Risk and Impact

This vulnerability allows any authenticated user to execute arbitrary SQL commands, potentially leading to unauthorized data access, modification, or even complete database corruption. The blast radius includes all users with access to the application, making it critical to address this issue immediately.

```

Keep reading