CVE-2026-87808

    Dashboard / Vulnerabilities / CVE-2026-87808

    CVE-2026-87808

    Published: 9 Sept 2026Last Modified: 11 Sept 2026

    Summary: SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

    Details: SiYuan versions <= 3.8.1 contain an incomplete fix for CVE-2026-32767 (GHSA-j7wh-x834-p3r7). The prior fix (commit d5e2d0bc) added an administrator check for SQL mode (method=2) in POST /api/search/fullTextSearchBlock, but the endpoint still does not enforce the application's read-only boundary: for method=2 it forwards caller-supplied SQL to the blocks database query path without calling model.CheckReadonly or CheckReadonlyStatementInBox. As a result, when a workspace runs in read-only mode (--readonly=true), an authenticated administrator can submit arbitrary SQL through /api/search/fullTextSearchBlock and obtain raw read access to the blocks database, even though the dedicated /api/query/sql endpoint is blocked in that mode. Fixed in v3.8.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87808.json, https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4qwm-3p58-vh67, https://nvd.nist.gov/vuln/detail/CVE-2026-87808, https://www.vulncheck.com/advisories/siyuan-before-3.8.2-read-only-boundary-bypass-via-fulltextsearchblock, https://github.com/siyuan-note/siyuan/commit/d5e2d0bce0dffef5f61bd8066954bc2d41181fc5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d5e2d0bce0dffef5f61bd8066954bc2d41181fc5

    Affected versions

    v3.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-87808 | CVE-DB