Auth bypass in B3log Siyuan
CVE-2026-30926
SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.003 (25.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 25.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: +0.000
Affected products
- B3log Siyuan
- Siyuan-Note Siyuan — versions < 3.5.10
Weakness classification (CWE)
References
- github.com/siyuan-note/siyuan/security/advisories/GHSA-f9cq-v43p-v523 (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-30926?
- CVE-2026-30926 is a high-severity vulnerability in B3log Siyuan, classified under Improper Access Control. CVSS score: 7.1/10. Published 2026-03-10.
- How severe is CVE-2026-30926?
- High severity. CVSS v3 base score is 7.1 out of 10.