CVE-2026-87808: SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock
SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in v3.8.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated SiYuan administrator. The affected condition is a workspace running with read-only mode enabled (--readonly=true).
What access does exploitation provide?
An administrator can send arbitrary SQL through POST /api/search/fullTextSearchBlock using SQL mode (method=2) and obtain raw read access to the blocks database. The issue does not describe integrity or availability impact.
Are default deployments affected?
The described bypass specifically applies when SiYuan is configured with --readonly=true. The provided information does not establish whether that mode is enabled by default.
What should be done if upgrading cannot happen immediately?
Restrict administrator access and prevent untrusted administrators from invoking POST /api/search/fullTextSearchBlock with method=2. The dedicated /api/query/sql endpoint being blocked in read-only mode does not mitigate this alternate path.
Which versions are affected and fixed?
SiYuan versions through 3.8.1 are affected. The issue is fixed in version 3.8.2.