CVE-2026-29073
published 2026-03-06CVE-2026-29073: SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not…
PriorityP355high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.32%
24.0th percentile
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| b3log | siyuan | <= 3.5.9 | — |
| github.com | siyuan-note_siyuan_kernel | 0 – 0.0.0-20260113130602-4ba64580c29c | — |
| siyuan-note | siyuan | < 3.6.0 | 3.6.0 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.7MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access in github.com/siyuan-note/siyuan/kernel
osv·2026-03-10
CVE-2026-29073 SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access in github.com/siyuan-note/siyuan/kernel
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access in github.com/siyuan-note/siyuan/kernel
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access in github.com/siyuan-note/siyuan/kernel
OSV
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
osv·2026-03-03
CVE-2026-29073 [MEDIUM] SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
### Summary
/api/query/sql allows users to run SQL directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any SQL query on the database.
### Details
The vulnerable endpoint is in kernel/api/sql.go
```go
func SQL(c *gin.Context) {
ret := gulu.Ret.NewResult()
defer c.JSON(http.StatusOK, ret)
arg, ok := util.JsonArg(c, ret)
if !ok {
return
}
stmt := arg["stmt"].(string)
result, err := sql.Query(stmt, model.Conf.Search.Limit) // ... runs arbitrary sql with no restrictions
}
```
The route in kernel/api/router.go only uses CheckAuth middleware
e.g (similar)
```go
ginServer.Handle("POST", "/api/query/sql", model.CheckAuth, SQL)
```
### PoC
St
GHSA
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
ghsa·2026-03-03
CVE-2026-29073 [MEDIUM] CWE-862 SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
SiYuan's direct SQL Query API accessible to Reader-level users enables unauthorized database access
### Summary
/api/query/sql allows users to run SQL directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any SQL query on the database.
### Details
The vulnerable endpoint is in kernel/api/sql.go
```go
func SQL(c *gin.Context) {
ret := gulu.Ret.NewResult()
defer c.JSON(http.StatusOK, ret)
arg, ok := util.JsonArg(c, ret)
if !ok {
return
}
stmt := arg["stmt"].(string)
result, err := sql.Query(stmt, model.Conf.Search.Limit) // ... runs arbitrary sql with no restrictions
}
```
The route in kernel/api/router.go only uses CheckAuth middleware
e.g (similar)
```go
ginServer.Handle("POST", "/api/query/sql", model.CheckAuth, SQL)
```
### PoC
St
No detection rules found.
No public exploits indexed.
2026-03-06
Published