DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72812: CVE-2026-72812: Broken Access Control and SQL Injection in SiYuan

#security #cve #cybersecurity

CVE-2026-72812: Broken Access Control and SQL Injection in SiYuan

Vulnerability ID: CVE-2026-72812
CVSS Score: 6.5
Published: 2026-09-03

A critical authorization bypass vulnerability exists in SiYuan personal knowledge management system before v3.7.4. The /api/ref/refreshBacklink endpoint lacks administrative role verification, enabling unauthenticated users to initiate database transactions and disk operations. When combined with an unsafe SQL generation pattern in nested backlink queries, an attacker can exploit a secondary SQL injection vulnerability to compromise local databases or cause denial-of-service conditions.

TL;DR

Unauthenticated attackers can abuse /api/ref/refreshBacklink in public mode to bypass authorization filters, trigger heavy CPU/disk usage, and exploit a secondary SQL injection flaw in the recursive query engine.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-862
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 6.5
  • EPSS Score: 0.00275
  • Impact: Bypass Write Protections, Secondary SQL Injection, Denial of Service
  • Exploit Status: PoC (Proof of Concept) available
  • KEV Status: Not listed

Affected Systems

  • SiYuan personal knowledge management system running versions prior to v3.7.4
  • SiYuan: < v3.7.4 (Fixed in: v3.7.4)

Code Analysis

Commit: 7d273c2

Fix SQL injection in QueryRefsByDefID and enforce CheckAdminRole and CheckReadonly filters on refreshBacklink API route

Exploit Details

Mitigation Strategies

  • Upgrade SiYuan application to version v3.7.4 or later.
  • Bind the default API port (6806) to localhost (127.0.0.1) instead of public interfaces.
  • Use reverse proxies to filter incoming traffic and block unauthorized access to the /api/* paths.

Remediation Steps:

  1. Identify the running version of the SiYuan deployment.
  2. Apply the vendor patch by pulling the latest official Docker image or updating the local executable to v3.7.4.
  3. Verify the routing logic by issuing an unauthenticated POST request to /api/ref/refreshBacklink; the system must return an authorization error.

References

Read the full report for CVE-2026-72812 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)