CVE-2026-32704: SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

March 13, 2026 (updated November 5, 2026)

POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes.

References

github.com/advisories/GHSA-4j3x-hhg2-fm2x
github.com/siyuan-note/siyuan/commit/5859cc222f2016874f778dd8f4ebafaab1cf7e0
github.com/siyuan-note/siyuan/issues/17209
github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x
nvd.nist.gov/vuln/detail/CVE-2026-32704

Code Behaviors & Features

Detect and mitigate CVE-2026-32704 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →