CVE-2026-29073 — SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access

CVE-2026-29073

SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access PUBLISHED

Description (CNA)

SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.

Affected (CNA)

Vendor / product	Versions
siyuan-note / siyuan	affected < 3.6.0

CWE

CWE-862, CWE-89

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jqwg-75qf-vmf9

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.