NIXPKGS-2026-0544
GitHub issue
published on 7 Mar 2026
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt accepted
- @mweinelt published on GitHub
SiYuan: Direct SQL Query API accessible to Reader-level users enables unauthorized database access
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the database. This issue has been patched in version 3.6.0.
References
-
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jqwg-75qf-vmf9 x_refsource_CONFIRM
Affected products
siyuan
- ==< 3.6.0
Matching in nixpkgs
Package maintainers
-
@TomaSajt TomaSajt
-
@L-Trump Luo Chen <ltrump@163.com>