CVE-2026-87808 Details
Description
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.
A read-only boundary bypass vulnerability has been identified in SiYuan versions through 3.8.1. This issue arises from an incomplete fix for a previous vulnerability, allowing authenticated administrators to execute arbitrary SQL queries via the 'POST /api/search/fullTextSearchBlock' endpoint. The endpoint fails to enforce the application's read-only restrictions, particularly when the workspace is set to read-only mode. As a result, administrators can access raw data from the blocks database, circumventing intended limitations. This vulnerability is especially concerning because the dedicated SQL query endpoint is already restricted in read-only workspaces.
Users can upgrade to SiYuan version 3.8.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 9, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4qwm-3p58-vh67 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/siyuan-note/siyuan/commit/d5e2d0bce0dffef5f61bd8066954bc2d41181fc5 | [email protected] | Source CodeVendor |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4qwm-3p58-vh67 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/siyuan-before-3.8.2-read-only-boundary-bypass-via-fulltextsearchblock | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SiYuan | <= 3.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 9, 2026 | New CVE Received | [email protected] |