CVE-2026-32704

MEDIUM

SiYuan renderSprig: missing admin check allows any user to read full workspace DB

Title source: cna
STIX 2.1

Description

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.

References (1)

Core 1
Core References

Scores

CVSS v3 6.5
EPSS 0.0025
EPSS Percentile 15.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-285 CWE-732
Status published
Products (3)
b3log/siyuan < 3.6.1
siyuan-note/siyuan 0 - 3.6.1Go
siyuan-note/siyuan < 3.6.1
Published Mar 16, 2026
Tracked Since Mar 16, 2026