CVE-2026-32704

SiYuan renderSprig: missing admin check allows any user to read full workspace DB

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.

Affected

siyuan-note · siyuan

CVSS v3.1 GITHUB

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2026-03-13

Updated

2026-03-16

Proof-of-concept exploits (1)

• advisories/GHSA-4j3x-hhg2-fm2x

Security advisories

• siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x

References

• CVE Record
• NVD entry