What is the CVSS score of CVE-2026-30926?

CVE-2026-30926 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Siyuan are affected by CVE-2026-30926?

SiYuan Note users running versions prior to 3.5.10 face a privilege escalation risk where low-privilege accounts can modify notebook content they should not be able to edit.

How to fix or mitigate CVE-2026-30926?

Within 24 hours: Inventory all SiYuan deployments and identify instances running versions prior to 3.5.10. Within 7 days: Disable the /api/block/appendHeadingChildren endpoint or restrict access via WAF rules if upgrading is not immediately possible; implement network segmentation to limit who can access the publish service. Within 30 days: Upgrade all SiYuan instances to version 3.5.10 or later once available; audit logs for unauthorized content modifications.

Siyuan CVE-2026-30926

HIGH

Improper Access Control (CWE-284)

2026-03-10 security-advisories@github.com

GHSA-f9cq-v43p-v523

Privilege Escalation Authentication Bypass Siyuan Suse

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 07:44 nvd

HIGH 7.1

DescriptionGitHub Advisory

SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.

AnalysisAI

SiYuan Note prior to version 3.5.10 contains an insufficient authorization flaw in the /api/block/appendHeadingChildren endpoint that allows authenticated users with read-only (RoleReader) privileges to modify notebook content by appending blocks to documents. The vulnerability exists because the endpoint applies only basic authentication checks instead of enforcing stricter administrative or read-only restrictions. Affected users should upgrade to version 3.5.10 or later, as no workaround is currently available and exploitation requires only network access and valid read-only credentials.

Technical ContextAI

This vulnerability (CWE-284: Improper Access Control) exists in the publish component. SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish us