CVE-2026-30926: SiYuan Privilege Escalation Vulnerability

CVE-2026-30926 Overview

CVE-2026-30926 is a privilege escalation vulnerability discovered in SiYuan, a personal knowledge management system. Prior to version 3.5.10, a critical flaw exists in the publish service that allows low-privilege publish accounts with RoleReader permissions to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint only requires model.CheckAuth role validation, which accepts RoleReader sessions, but fails to enforce stricter authorization checks such as CheckAdminRole or CheckReadonly. This improper access control enables remote authenticated users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.

Critical Impact

Remote authenticated users with read-only privileges can escalate their permissions to modify notebook content, compromising data integrity in SiYuan Note instances.

Affected Products

• SiYuan Note versions prior to 3.5.10
• SiYuan publish service with RoleReader authentication enabled
• Deployments exposing the /api/block/appendHeadingChildren endpoint

Discovery Timeline

• 2026-03-10 - CVE-2026-30926 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30926

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in SiYuan's API authorization layer. The /api/block/appendHeadingChildren endpoint is designed to allow users to append content blocks to existing document headings. However, the endpoint's authorization mechanism only validates that a user has authenticated via model.CheckAuth, which accepts sessions from users with RoleReader permissions. The absence of additional authorization checks means that users who should only have read access can perform write operations, effectively escalating their privileges within the application.

The attack is network-accessible and requires only low-privilege authentication, making it relatively easy to exploit for any authenticated user on a vulnerable SiYuan instance. While the vulnerability does not allow arbitrary code execution or provide access to confidential data beyond what the attacker already has, it severely compromises the integrity of stored notes and documents.

Root Cause

The root cause of this vulnerability is the missing authorization enforcement at the API endpoint level. The /api/block/appendHeadingChildren endpoint relies solely on model.CheckAuth for access validation, which is designed to verify authentication status but does not differentiate between user roles. The endpoint should implement additional checks such as CheckAdminRole or CheckReadonly to ensure that only users with appropriate write permissions can modify document content. This oversight allows RoleReader sessions to bypass the intended access control restrictions.

Attack Vector

The attack vector is network-based, requiring an authenticated session with RoleReader privileges. An attacker would:

1. Obtain valid credentials for a publish account with RoleReader role
2. Authenticate to the SiYuan instance and obtain a valid session token
3. Send crafted requests to the /api/block/appendHeadingChildren endpoint with the authenticated session
4. Append arbitrary content blocks to existing documents, modifying notebook content

The vulnerability allows authenticated attackers with read-only access to modify document content through the API endpoint. The attacker sends authenticated requests to /api/block/appendHeadingChildren with block data to append. Since the endpoint only checks for basic authentication (model.CheckAuth) and not role-based permissions, the request succeeds even for RoleReader accounts. For detailed technical analysis, see the GitHub Security Advisory.

Detection Methods for CVE-2026-30926

Indicators of Compromise

• Unexpected modifications to notebook documents by users with read-only permissions
• API access logs showing POST requests to /api/block/appendHeadingChildren from RoleReader sessions
• Audit trail entries indicating content changes attributed to accounts that should not have write access
• New or unexpected blocks appearing in documents without corresponding authorized user activity

Detection Strategies

• Monitor API access logs for requests to /api/block/appendHeadingChildren from accounts with RoleReader role assignments
• Implement alerting on document modification events that originate from read-only user sessions
• Review authentication and authorization logs for privilege escalation patterns
• Deploy application-layer firewalls to inspect and alert on suspicious API activity

Monitoring Recommendations

• Enable detailed logging for all API endpoints that modify document content
• Configure SIEM rules to correlate user role assignments with write operation attempts
• Implement real-time alerting for unauthorized modification attempts
• Establish baseline behavior patterns for read-only accounts to detect anomalies

How to Mitigate CVE-2026-30926

Immediate Actions Required

• Upgrade SiYuan Note to version 3.5.10 or later immediately
• Review recent document modifications for unauthorized changes by RoleReader accounts
• Audit user accounts and their assigned roles, removing unnecessary publish access
• Temporarily disable the publish service if immediate patching is not possible

Patch Information

The vulnerability is addressed in SiYuan Note version 3.5.10. The patch implements proper role-based authorization checks on the /api/block/appendHeadingChildren endpoint, ensuring that only users with appropriate write permissions can modify document content. Organizations should upgrade to the patched version as soon as possible. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to the SiYuan API endpoints using firewall rules or network segmentation
• Disable the publish service entirely if not required for business operations
• Implement a reverse proxy with additional authorization checks for sensitive API endpoints
• Limit RoleReader account creation and audit existing publish accounts for necessity

# Example: Restrict access to SiYuan API using iptables
# Allow only trusted IP ranges to access the SiYuan service
iptables -A INPUT -p tcp --dport 6806 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 6806 -j DROP