CVE-2026-32767 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SiYuan v3.6.0- has an **Authorization Bypass** on `/api/search/fullTextSearchBlock`. 💥 **Consequences**: Leads to **Arbitrary SQL Execution**. Total compromise of data integrity and confidentiality.

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection). 🔍 **Flaw**: The search endpoint fails to verify user permissions before processing SQL queries, allowing unauthenticated injection.

Q: Who is affected? (Versions/Components)

👥 **Affected**: **SiYuan Note** (Personal Knowledge Management). 📦 **Versions**: **v3.6.0 and earlier**. 🔧 **Component**: `/api/search/fullTextSearchBlock` endpoint.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔓 **Auth**: **None Required** (`PR:N`). 🌐 **Network**: **Remote** (`AV:N`). 🎯 **Complexity**: **Low** (`AC:L`). Easy to exploit.

Q: Is there a public Exp? (PoC/Wild Exploitation)

📢 **Public Exp?**: **Yes/Imminent**. 🔗 **References**: GitHub Issue #17209 and Security Advisory GHSA-j7wh-x834-p3r7 are public. ⚠️ **Status**: PoCs likely circulating given the severity.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1️⃣ Check SiYuan version in settings. 2️⃣ Scan for `/api/search/fullTextSearchBlock` exposure. 3️⃣ Monitor logs for SQL errors or unauthorized search requests.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: **YES**. 📦 **Patch**: Upgrade to **v3.6.1**. 🔗 **Link**: [GitHub Release v3.6.1](https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1).

Q: What if no patch? (Workaround)

🛑 **No Patch?**: 1️⃣ **Block Endpoint**: Firewall rule to deny `/api/search/fullTextSearchBlock`. 2️⃣ **WAF**: Deploy SQL injection protection rules. 3️⃣ **Isolate**: Disconnect from internet until patched.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P0**. 💡 **Action**: **Patch Immediately**. CVSS 9.1 (High) with no auth required makes this a high-risk target for automated attacks.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: SiYuan v3.6.0- has an **Authorization Bypass** on `/api/search/fullTextSearchBlock`. <br>💥 **Consequences**: Leads to **Arbitrary SQL Execution**. Total compromise of data integrity and confidentiality.

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-89** (SQL Injection). <br>🔍 **Flaw**: The search endpoint fails to verify user permissions before processing SQL queries, allowing unauthenticated injection.

Q3Who is affected? (Versions/Components)

👥 **Affected**: **SiYuan Note** (Personal Knowledge Management). <br>📦 **Versions**: **v3.6.0 and earlier**. <br>🔧 **Component**: `/api/search/fullTextSearchBlock` endpoint.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: <br>1️⃣ **Bypass Auth**: No login required. <br>2️⃣ **Execute SQL**: Run arbitrary commands. <br>3️⃣ **Access Data**: Read/Modify/Delete all notes and user data.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: **None Required** (`PR:N`). <br>🌐 **Network**: **Remote** (`AV:N`). <br>🎯 **Complexity**: **Low** (`AC:L`). Easy to exploit.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📢 **Public Exp?**: **Yes/Imminent**. <br>🔗 **References**: GitHub Issue #17209 and Security Advisory GHSA-j7wh-x834-p3r7 are public. <br>⚠️ **Status**: PoCs likely circulating given the severity.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1️⃣ Check SiYuan version in settings. <br>2️⃣ Scan for `/api/search/fullTextSearchBlock` exposure. <br>3️⃣ Monitor logs for SQL errors or unauthorized search requests.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed?**: **YES**. <br>📦 **Patch**: Upgrade to **v3.6.1**. <br>🔗 **Link**: [GitHub Release v3.6.1](https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1).

Q9What if no patch? (Workaround)

🛑 **No Patch?**: <br>1️⃣ **Block Endpoint**: Firewall rule to deny `/api/search/fullTextSearchBlock`. <br>2️⃣ **WAF**: Deploy SQL injection protection rules. <br>3️⃣ **Isolate**: Disconnect from internet until patched.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>🚨 **Priority**: **P0**. <br>💡 **Action**: **Patch Immediately**. CVSS 9.1 (High) with no auth required makes this a high-risk target for automated attacks.

Continue exploring

Vulnerability detail Full AI analysis (login) siyuan-note CWE-89