CyberRota Analysis
AI-GeneratedVersions of SiYuan up to 3.8.1 are vulnerable due to an incomplete fix that allows authenticated administrators to bypass read-only restrictions and execute arbitrary SQL queries through the /api/search/fullTextSearchBlock endpoint. This vulnerability could lead to unauthorized access to sensitive data within the blocks database, undermining the application's security model. Organizations using SiYuan, particularly those operating in environments with strict data access controls, should prioritize upgrading to version 3.8.2 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.