CVE-2026-87808

SiYuan versions up to and including 3.8.1 ship an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7): the POST /api/search/fullTextSearchBlock endpoint added an administrator check for SQL mode (method=2) in commit d5e2d0bc, but it still forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through this search endpoint and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. The flaw is a read-only enforcement bypass (CWE-693) rather than a pre-authentication SQL injection, so it is only exploitable by accounts that already hold administrator credentials against a read-only workspace. All SiYuan deployments running 3.8.1 or earlier that operate workspaces in read-only mode are affected; the issue is fixed in v3.8.2. It is rated 8.7 (High) in CVSS 4.0, no public proof-of-concept is known, and it is not in CISA's KEV, so exploitation is not currently documented.

What to do: Upgrade to SiYuan v3.8.2, which completes the read-only enforcement on /api/search/fullTextSearchBlock. Where an immediate upgrade is not possible, stop running workspaces with --readonly=true or restrict/block access to /api/search/fullTextSearchBlock at a reverse proxy, and audit the blocks database for unexpected queries. Since exploitation requires administrator credentials, review how admin accounts on read-only (e.g., shared or published) workspaces are issued and shared.