Question 1

What is this vulnerability? (Essence + Consequences)

Accepted Answer

🚨 **Essence**: SiYuan v3.6.0- has an **Authorization Bypass** on `/api/search/fullTextSearchBlock`.
💥 **Consequences**: Leads to **Arbitrary SQL Execution**. Total compromise of data integrity and confidentiality.

Question 2

Root Cause? (CWE/Flaw)

Accepted Answer

🛡️ **Root Cause**: **CWE-89** (SQL Injection).
🔍 **Flaw**: The search endpoint fails to verify user permissions before processing SQL queries, allowing unauthenticated injection.

Question 3

Who is affected? (Versions/Components)

Accepted Answer

👥 **Affected**: **SiYuan Note** (Personal Knowledge Management).
📦 **Versions**: **v3.6.0 and earlier**.
🔧 **Component**: `/api/search/fullTextSearchBlock` endpoint.

Question 4

What can hackers do? (Privileges/Data)

Accepted Answer

💀 **Attacker Actions**:
1️⃣ **Bypass Auth**: No login required.
2️⃣ **Execute SQL**: Run arbitrary commands.
3️⃣ **Access Data**: Read/Modify/Delete all notes and user data.…

Question 5

Is exploitation threshold high? (Auth/Config)

Accepted Answer

⚡ **Threshold**: **LOW**.
🔓 **Auth**: **None Required** (`PR:N`).
🌐 **Network**: **Remote** (`AV:N`).
🎯 **Complexity**: **Low** (`AC:L`). Easy to exploit.

Question 6

Is there a public Exp? (PoC/Wild Exploitation)

Accepted Answer

📢 **Public Exp?**: **Yes/Imminent**.
🔗 **References**: GitHub Issue #17209 and Security Advisory GHSA-j7wh-x834-p3r7 are public.
⚠️ **Status**: PoCs likely circulating given the severity.

Question 7

How to self-check? (Features/Scanning)

Accepted Answer

🔍 **Self-Check**:
1️⃣ Check SiYuan version in settings.
2️⃣ Scan for `/api/search/fullTextSearchBlock` exposure.
3️⃣ Monitor logs for SQL errors or unauthorized search requests.

Question 8

Is it fixed officially? (Patch/Mitigation)

Accepted Answer

✅ **Fixed?**: **YES**.
📦 **Patch**: Upgrade to **v3.6.1**.
🔗 **Link**: [GitHub Release v3.6.1](https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1).

Question 9

What if no patch? (Workaround)

Accepted Answer

🛑 **No Patch?**:
1️⃣ **Block Endpoint**: Firewall rule to deny `/api/search/fullTextSearchBlock`.
2️⃣ **WAF**: Deploy SQL injection protection rules.
3️⃣ **Isolate**: Disconnect from internet until patched.

Question 10

Is it urgent? (Priority Suggestion)

Accepted Answer

🔥 **Urgency**: **CRITICAL**.
🚨 **Priority**: **P0**.
💡 **Action**: **Patch Immediately**. CVSS 9.1 (High) with no auth required makes this a high-risk target for automated attacks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-32767 — AI Deep Analysis Summary

Q1What is this vulnerability? (Essence + Consequences)

Q2Root Cause? (CWE/Flaw)

Q3Who is affected? (Versions/Components)

Q4What can hackers do? (Privileges/Data)

Q5Is exploitation threshold high? (Auth/Config)

Q6Is there a public Exp? (PoC/Wild Exploitation)

Q7How to self-check? (Features/Scanning)

Q8Is it fixed officially? (Patch/Mitigation)

Q9What if no patch? (Workaround)

Q10Is it urgent? (Priority Suggestion)

Continue exploring