CVE-2026-32704

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p16

Published

Mar 16, 2026 (Mar 16, 2026)

Modified

Jun 17, 2026

Description

SiYuan is a personal knowledge management system. Prior to 3.6.1, POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. This vulnerability is fixed in 3.6.1.

Vendors: b3log
Products: siyuan
Weakness: CWE-285, CWE-732
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.