CVE-2026-30926

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-30926", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-07T16:40:05.884Z", "datePublished": "2026-03-09T21:07:07.481Z", "dateUpdated": "2026-03-10T14:58:53.053Z"}, "containers": {"cna": {"title": "SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523"}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"version": "< 3.5.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T21:07:07.481Z"}, "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes."}], "source": {"advisory": "GHSA-f9cq-v43p-v523", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T14:58:48.132153Z", "id": "CVE-2026-30926", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:58:53.053Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-30926", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:58:48.132153Z"}}}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T14:58:42.515Z"}}], "cna": {"title": "SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content", "source": {"advisory": "GHSA-f9cq-v43p-v523", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "siyuan-note", "product": "siyuan", "versions": [{"status": "affected", "version": "< 3.5.10"}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523", "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-09T21:07:07.481Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30926", "state": "PUBLISHED", "dateUpdated": "2026-03-10T14:58:53.053Z", "dateReserved": "2026-03-07T16:40:05.884Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-09T21:07:07.481Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "siyuan", "vendor": "siyuan-note", "versions": [{"status": "affected", "version": "< 3.5.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:b3log:siyuan:*:*:*:*:*:*:*:*", "matchCriteriaId": "0E7B145F-4786-4534-B4D6-A947F4CD06FE", "versionEndExcluding": "3.5.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes."}, {"lang": "es", "value": "SiYuan es un sistema de gesti\u00f3n de conocimiento personal. Anteriormente a la 3.5.10, existe una vulnerabilidad de escalada de privilegios en el servicio de publicaci\u00f3n de SiYuan Note que permite a las cuentas de publicaci\u00f3n de bajo privilegio (RoleReader) modificar el contenido del cuaderno a trav\u00e9s del endpoint de la API /api/block/appendHeadingChildren. El endpoint requiere solo el rol model.CheckAuth, que acepta sesiones de RoleReader, pero no aplica comprobaciones m\u00e1s estrictas, como CheckAdminRole o CheckReadonly. Esto permite a los usuarios de publicaci\u00f3n remotos autenticados con privilegios de solo lectura a\u00f1adir nuevos bloques a documentos existentes, comprometiendo la integridad de las notas almacenadas."}], "id": "CVE-2026-30926", "lastModified": "2026-06-17T10:33:09.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30926", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T14:58:48.132153Z", "version": "2.0.3"}}]}, "published": "2026-03-10T07:44:56.943", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.5.10)"}}], "enrichment": {"confidence": 84.0, "confidence_source": "matching", "scores": [{"score": 84.0, "source": "matching"}]}, "original": {"product": "siyuan", "source": "cna", "vendor": "siyuan-note"}, "product": "siyuan", "vendor": "siyuan"}], "analysis": {"en": {"generated_at": "2026-04-16T10:11:57.210681+00:00", "value": {"mitigation_remediation": ["Upgrade SiYuan to version 3.5.10 or later, which fixes the authorization check on /api/block/appendHeadingChildren", "Revoke the Publish (RoleReader) privilege from users who should not modify notebooks or disable publishing for these accounts entirely", "Deploy monitoring of the /api/block/appendHeadingChildren API to alert on unexpected content append operations"], "summary": {"action": "Apply Patch", "impact": "Authorization bypass leading to data integrity compromise"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the SiYuan Note application, specifically versions prior to 3.5.10. Users of older releases who have assigned the Publish role with read\u2011only privileges are at risk.", "description_and_impact": "A flaw in the publish service allows low\u2011privilege users with the RoleReader role to append new blocks to existing notebooks through the /api/block/appendHeadingChildren endpoint. The endpoint only verifies a generic authenticated session and does not check for higher privileges such as Admin or Read\u2011Only. As a result, authenticated users can modify the content of notes, providing a privilege escalation route that undermines the integrity of stored data.", "risk_and_exploitability": "The CVSS score is 7.1, indicating a medium severity vulnerability. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated via a publish account and possess the RoleReader role; they can then use the vulnerable API endpoint to inject or modify notebook blocks. Because the exploit requires only low\u2011privilege credentials, the risk is significant for any user who has been granted publish access."}}}}, "created": "2026-03-10T14:07:01.665590+00:00", "updated": "2026-04-16T10:15:26.112812+00:00", "vendors": ["siyuan", "siyuan$PRODUCT$siyuan"]}