CVE-2026-32704 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to…
Medium CVSS: 6.5

CVE-2026-32704

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.
Vendor
B3log
Product
Siyuan
CWE
CWE-285
Yayın Tarihi
2026-03-16 14:19:41
Güncelleme
2026-03-17 19:02:25
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-285 Siyuan MEDIUM B3log 2026

Referanslar

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x