CVE-2026-30926— SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content

SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content

SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

访问控制不恰当

SiYuan 安全漏洞

SiYuan是SiYuan开源的一个隐私至上的个人知识管理系统。 SiYuan 3.5.10之前版本存在安全漏洞，该漏洞源于/api/block/appendHeadingChildren API端点权限检查不足，可能导致低权限发布账户修改笔记本内容。

N/A

N/A