Auth bypass in Siyuan-note Siyuan
CVE-2026-45371
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs. POST /api/graph/getGraph, POST /api/graph/getLocalGraph, POST /api/sync/setSyncInte…
EPSS: 0.000 (13.5th percentile) — read the EPSS interpretation.
Affected products
- Siyuan-note Siyuan — versions < 3.7.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)