CVE-2026-30926
Reported by github_m · Published March 9, 2026
github.com/siyuan-note/siyuan/kernel is fixed in 0.0.0-20260304035530-d03ebdec8279 (Go Modules)
SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the publish service of SiYuan Note that allows low-privilege publish accounts (RoleReader) to modify notebook content via the /api/block/appendHeadingChildren API endpoint. The endpoint requires only the model.CheckAuth role, which accepts RoleReader sessions, but it does not enforce stricter checks, such as CheckAdminRole or CheckReadonly. This allows remote authenticated publish users with read-only privileges to append new blocks to existing documents, compromising the integrity of stored notes.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| github.com/siyuan-note/siyuan/kernel | Go Modules | 0.0.0-20260304035530-d03ebdec8279 |
| siyuan | b3log | 3.5.10 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| siyuan-note | siyuan | < 3.5.10 |
| siyuan-note | siyuan | 0 |
| github.com | siyuan-note/siyuan/kernel | 0 |
Timeline
- Mar 9, 2026 CVE Published
- Mar 10, 2026 EPSS Score (30 in total, the first dated here)
- Mar 10, 2026 CVE Updated
- Mar 17, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 17, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-30926
vulnetix vdb fixes CVE-2026-30926Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-30926/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart