CVE-2026-87808

SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.

• CWE-693

• https://github.com/siyuan-note/siyuan/commit/d5e2d0bce0dffef5f61bd8066954bc2d41181fc5
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4qwm-3p58-vh67
• https://www.vulncheck.com/advisories/siyuan-before-3.8.2-read-only-boundary-bypass-via-fulltextsearchblock
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4qwm-3p58-vh67

Published

Sep 9, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8779A vulnerability was determined in omec-project amf up to 2.1…4.3
• CVE-2026-87794bestzip versions 2.2.6 and 3.0.2 contain an argument injecti…8.4
• CVE-2026-87795zstd-jni versions before 1.5.7-14 fail to validate offset an…8.2
• CVE-2026-8780A vulnerability was identified in omec-project amf up to 2.1…4.3
• CVE-2026-87806Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.…7.4
• CVE-2026-87807siyuan versions before v3.8.2 contain an authenticated SQL i…7.5
• CVE-2026-87809Siyuan before v3.8.2 fails to apply publish-access filtering…6.5
• CVE-2026-8781A security flaw has been discovered in omec-project amf up t…4.3
• CVE-2026-87810Siyuan before v3.8.2 contains an information disclosure vuln…5.3
• CVE-2026-87811SiYuan before v3.8.2 inserts persisted notebook template pat…7.3
• CVE-2026-87812SiYuan before v3.8.2 contains a stored cross-site scripting …6.8
• CVE-2026-87813SiYuan before v3.8.2 contains a stored cross-site scripting …7.3