CVE-2026-32704: B3log Siyuan SQL Injection Vulnerability

CVE-2026-32704 Overview

CVE-2026-32704 is an authorization bypass vulnerability in SiYuan, a personal knowledge management system developed by B3log. Prior to version 3.6.1, the POST /api/template/renderSprig endpoint lacks proper role verification through the model.CheckAdminRole function, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database. This broken access control flaw enables attackers to exfiltrate all note content, metadata, and custom attributes stored within the application.

Critical Impact

Any authenticated user can bypass authorization controls to execute arbitrary SQL queries, leading to complete data exfiltration of the entire SiYuan workspace database including sensitive notes, metadata, and user attributes.

Affected Products

• B3log SiYuan versions prior to 3.6.1
• SiYuan personal knowledge management deployments with authenticated user access
• Self-hosted and cloud-based SiYuan installations running vulnerable versions

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-32704 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32704

Vulnerability Analysis

This vulnerability stems from a missing authorization check (CWE-285: Improper Authorization) in the SiYuan template rendering API. The /api/template/renderSprig endpoint processes template rendering requests but fails to verify whether the requesting user has administrative privileges before executing database operations. This architectural oversight allows low-privileged authenticated users to craft malicious requests that directly interact with the underlying workspace database.

The Sprig template engine, when combined with database access functions, provides a powerful but dangerous capability when exposed without proper authorization controls. An attacker with basic authenticated access can leverage this endpoint to construct and execute arbitrary SQL queries, completely bypassing the intended access control model.

Root Cause

The root cause is a missing call to model.CheckAdminRole in the request handler for the /api/template/renderSprig endpoint. While other sensitive API endpoints in SiYuan properly verify administrative privileges before processing requests, this particular endpoint was deployed without the necessary authorization gate. This creates a privilege escalation vector where any authenticated user can perform actions that should be restricted to administrators only.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user. The attack requires low privileges (basic authenticated access) and no user interaction. An attacker would need to:

1. Authenticate to the SiYuan application with any valid user account
2. Craft a malicious POST request to the /api/template/renderSprig endpoint
3. Include SQL query payloads within the Sprig template syntax
4. Extract sensitive data from the database response

The attack surface includes all note content, metadata fields, custom attributes, and potentially other stored information within the SiYuan workspace database. Since no special privileges are required beyond basic authentication, the barrier to exploitation is relatively low for insider threats or compromised user accounts.

Detection Methods for CVE-2026-32704

Indicators of Compromise

• Unusual volume of requests to /api/template/renderSprig endpoint from non-administrator accounts
• SQL-like patterns appearing in template rendering request bodies
• Large data responses from the template rendering API that may indicate data exfiltration
• Authentication logs showing access to sensitive endpoints by users without administrative roles

Detection Strategies

• Implement web application firewall (WAF) rules to detect SQL injection patterns in requests to /api/template/renderSprig
• Monitor API access logs for template rendering requests from users who should not have administrative access
• Deploy anomaly detection to identify unusual data volume patterns in API responses
• Review authentication and authorization logs for privilege escalation attempts

Monitoring Recommendations

• Enable detailed logging for all requests to the /api/template/renderSprig endpoint
• Set up alerts for any template rendering activity from non-administrator user accounts
• Monitor database query logs for unexpected SELECT statements or data extraction patterns
• Implement network-level monitoring for large data egress following API interactions

How to Mitigate CVE-2026-32704

Immediate Actions Required

• Upgrade SiYuan to version 3.6.1 or later immediately
• Review access logs for any evidence of exploitation prior to patching
• Audit user accounts to identify any unauthorized access to sensitive data
• Consider temporarily restricting access to the SiYuan instance until patching is complete

Patch Information

B3log has addressed this vulnerability in SiYuan version 3.6.1 by adding the missing model.CheckAdminRole authorization check to the /api/template/renderSprig endpoint. Organizations should update to version 3.6.1 or later to remediate this vulnerability. For detailed information about the fix, refer to the GitHub Security Advisory GHSA-4j3x-hhg2-fm2x.

Workarounds

• Implement network-level access controls to restrict who can reach the SiYuan API endpoints
• Deploy a reverse proxy or WAF to filter requests to /api/template/renderSprig until patching is possible
• Temporarily disable or restrict the template rendering functionality if not business-critical
• Limit authenticated access to only trusted users until the system can be upgraded

If you cannot immediately upgrade, consider implementing additional authentication layers or temporarily taking the SiYuan instance offline until the patch can be applied. Review the security advisory for additional mitigation guidance from the vendor.