PT-2026-40726 · Siyuan · Siyuan

Starplatinu · Published 2026-05-13 · Updated 2026-05-14 · CVE-2026-45147

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0

Description The endpoint "/api/tag/getTag" is registered using only the model.CheckAuth middleware, missing the model.CheckAdminRole and model.CheckReadonly checks. This allows any authenticated user, including those with RoleReader or RoleEditor permissions on read-only workspaces, to perform unauthorized configuration writes. By providing a sort argument to the endpoint, an attacker can mutate model.Conf.Tag.Sort and trigger the model.Conf.Save() function, which atomically rewrites the entire workspace conf.json file. This can lead to the rollback of other legitimate configuration settings if a write-race occurs.

Recommendations Update to version 3.7.0. As a temporary workaround, restrict access to the "/api/tag/getTag" endpoint to authorized administrators only.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2026-45147

GHSA-6R88-8V7Q-Q4P2

Affected Products

Siyuan

References · 4

• 🔥 https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6r88-8v7q-q4p2 · Exploit
• https://osv.dev/vulnerability/GHSA-6r88-8v7q-q4p2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45147 · Security Note
• https://github.com/siyuan-note/siyuan · Note