CVE-2026-32767: B3log Siyuan Auth Bypass Vulnerability

CVE-2026-32767 Overview

CVE-2026-32767 is a SQL Injection vulnerability affecting SiYuan, a personal knowledge management system developed by B3log. The vulnerability exists in the /api/search/fullTextSearchBlock endpoint where user-supplied input is passed directly as a raw SQL statement to the underlying SQLite database without proper authorization or read-only checks when the method parameter is set to 2. This flaw allows any authenticated user, including those with the Reader role, to execute arbitrary SQL statements against the application's database, enabling unauthorized data access, modification, or deletion.

Critical Impact

This authorization bypass vulnerability allows low-privileged users to execute arbitrary SQL commands (SELECT, DELETE, UPDATE, DROP TABLE) against the SiYuan database, potentially leading to complete data compromise, data loss, or application destruction.

Affected Products

• B3log SiYuan versions 3.6.0 and below

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-32767 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32767

Vulnerability Analysis

The vulnerability stems from an inconsistent implementation of access controls across the SiYuan API. While the dedicated SQL endpoint (/api/query/sql) correctly enforces CheckAdminRole and CheckReadonly middleware to restrict database operations to administrators, the /api/search/fullTextSearchBlock endpoint bypasses these security controls entirely.

When an attacker sends a request to the vulnerable endpoint with the method parameter set to 2, the application passes the user-supplied input directly to the SQLite database engine without sanitization or authorization verification. This allows any authenticated user—regardless of their assigned role—to craft and execute arbitrary SQL statements.

The impact of this vulnerability is severe: attackers can read sensitive data from any table, modify or delete existing records, drop entire tables, and potentially compromise the integrity of the entire knowledge base. This is particularly concerning for multi-user SiYuan deployments where Reader-role users should only have read access to content.

Root Cause

The root cause is a missing authorization check in the /api/search/fullTextSearchBlock endpoint handler. When method=2 is specified, the code path fails to invoke the CheckAdminRole and CheckReadonly middleware functions that are correctly implemented on the /api/query/sql endpoint. This represents an inconsistency in the application's security model where equivalent database access functionality has disparate access control enforcement.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with any valid SiYuan account, including a low-privileged Reader role, can exploit this vulnerability by sending crafted HTTP requests to the /api/search/fullTextSearchBlock endpoint. By setting the method parameter to 2 and supplying a malicious SQL statement in the request body, the attacker can execute arbitrary database commands.

The exploitation scenario involves:

1. Authenticating to the SiYuan application with any valid credentials
2. Crafting an HTTP POST request to /api/search/fullTextSearchBlock with method=2
3. Including arbitrary SQL statements in the request payload
4. The SQL statements execute directly against the SQLite database without role verification

For technical implementation details, refer to the GitHub Security Advisory GHSA-j7wh-x834-p3r7 and the related issue discussion.

Detection Methods for CVE-2026-32767

Indicators of Compromise

• Unusual HTTP POST requests to /api/search/fullTextSearchBlock with method=2 parameter from non-admin users
• SQL keywords (DROP, DELETE, UPDATE, INSERT, UNION) appearing in search API request payloads
• Database integrity errors or unexpected table modifications without corresponding admin activity
• Reader-role accounts accessing or modifying data outside their permitted scope

Detection Strategies

• Implement web application firewall (WAF) rules to inspect requests to /api/search/fullTextSearchBlock for SQL injection patterns
• Enable detailed request logging for all API endpoints and alert on requests containing raw SQL keywords
• Monitor application logs for database errors that may indicate injection attempts
• Audit user activity logs for Reader-role accounts performing operations inconsistent with their permissions

Monitoring Recommendations

• Configure SIEM alerts for high-volume or anomalous requests to the vulnerable endpoint
• Implement database activity monitoring to detect unauthorized schema changes or bulk data operations
• Review authentication logs to identify compromised accounts being used to exploit the vulnerability
• Establish baseline API usage patterns to detect deviations indicative of exploitation

How to Mitigate CVE-2026-32767

Immediate Actions Required

• Upgrade SiYuan to version 3.6.1 or later immediately
• Audit database contents for signs of unauthorized modification or data exfiltration
• Review access logs to identify potential exploitation attempts prior to patching
• Rotate credentials for any accounts that may have been compromised

Patch Information

B3log has released SiYuan version 3.6.1 which addresses this vulnerability by implementing proper authorization checks on the /api/search/fullTextSearchBlock endpoint. The fix ensures that the CheckAdminRole and CheckReadonly middleware are enforced when the method=2 parameter is used.

Refer to the official release notes for upgrade instructions. The specific code changes can be reviewed in the security patch commit.

Workarounds

• If immediate patching is not possible, restrict network access to the SiYuan application to trusted users only
• Implement a reverse proxy with request filtering to block requests containing method=2 to the /api/search/fullTextSearchBlock endpoint
• Temporarily disable Reader-role accounts until the patch can be applied
• Implement network segmentation to limit the blast radius of potential exploitation

# Example nginx configuration to block vulnerable endpoint parameter
location /api/search/fullTextSearchBlock {
    if ($request_body ~* "method.*2") {
        return 403;
    }
    proxy_pass http://siyuan_backend;
}