CVE-2026-32704

SiYuan exposes a vulnerability in the renderSprig endpoint prior to version 3.6.1. In POST /api/template/renderSprig, the missing model.CheckAdminRole check allows any authenticated user to execute raw SQL via the template engine (querySQL), enabling exfiltration of the workspace database content...

GHSA-4J3X-HHG2-FM2X SiYuan's renderSprig has a missing admin check that allows any user to read full workspace DB

Summary POST /api/template/renderSprig lacks model.CheckAdminRole, allowing any authenticated user to execute arbitrary SQL queries against the SiYuan workspace database and exfiltrate all note content, metadata, and custom attributes. Details File: kernel/api/router.go Every sensitive endpoint i...