CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7194 vulnerabilities reference this CWE, most recent first.
GHSA-J756-F273-XHP4
Vulnerability from github – Published: 2021-05-21 16:22 – Updated: 2024-05-21 15:22(This advisory is canonically https://advisories.nats.io/CVE/CVE-2021-3127.txt)
Problem Description
The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects. Some Exports are public, such that anyone can import the relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.
The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.
As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the importing account is not rejected, and use it to import any Subject from the Exporting account, not just the Subject referenced in the Import Token.
The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.
The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.
Affected versions
JWT library
- all versions prior to 2.0.1
- fixed after nats-io/jwt#149 landed (2021-03-14)
NATS Server
- Version 2 prior to 2.2.0
- 2.0.0 through and including 2.1.9 are vulnerable
- fixed with nats-io/nats-server@423b79440c (2021-03-14)
Impact
In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.
Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.
Workaround
Deny access to clients to update their account JWT in the account server.
Solution
Upgrade the JWT dependency in any application using it.
Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).
Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/nats-io/nats-server/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-755",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-20T21:01:49Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "(This advisory is canonically \u003chttps://advisories.nats.io/CVE/CVE-2021-3127.txt\u003e)\n\n## Problem Description\n\nThe NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects. Some Exports are public, such that anyone can import the relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.\n\nThe JWT library\u0027s validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.\n\nAs a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.\n\nThe NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.\n\nThe CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.\n\n\n## Affected versions\n\n#### JWT library\n\n * all versions prior to 2.0.1\n * fixed after nats-io/jwt#149 landed (2021-03-14)\n\n#### NATS Server\n\n * Version 2 prior to 2.2.0\n + 2.0.0 through and including 2.1.9 are vulnerable\n * fixed with nats-io/nats-server@423b79440c (2021-03-14)\n\n\n## Impact\n\nIn deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.\n\nAbuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.\n\n\n## Workaround\n\nDeny access to clients to update their account JWT in the account server.\n\n\n## Solution\n\nUpgrade the JWT dependency in any application using it.\n\nUpgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).\n\nAudit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at \u003chttps://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a\u003e.",
"id": "GHSA-j756-f273-xhp4",
"modified": "2024-05-21T15:22:51Z",
"published": "2021-05-21T16:22:20Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nats-io/jwt/security/advisories/GHSA-62mh-w5cv-p88c"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-j756-f273-xhp4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3127"
},
{
"type": "WEB",
"url": "https://github.com/nats-io/nats-server/commit/423b79440c80c863de9f4e20548504e6c5d5e403"
},
{
"type": "WEB",
"url": "https://advisories.nats.io/CVE/CVE-2021-3127.txt"
},
{
"type": "PACKAGE",
"url": "https://github.com/nats-io/nats-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "github.com/nats-io/nats-server Import token permissions checking not enforced"
}
GHSA-J75Q-FM7G-J9HX
Vulnerability from github – Published: 2026-09-22 18:33 – Updated: 2026-09-22 18:33Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
{
"affected": [],
"aliases": [
"CVE-2026-75723"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-22T18:17:16Z",
"severity": "CRITICAL"
},
"details": "Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.",
"id": "GHSA-j75q-fm7g-j9hx",
"modified": "2026-09-22T18:33:33Z",
"published": "2026-09-22T18:33:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75723"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/campaign/apsb26-142.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J79M-7C8R-83MC
Vulnerability from github – Published: 2022-02-17 00:00 – Updated: 2022-02-26 00:01VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.
{
"affected": [],
"aliases": [
"CVE-2021-22042"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-16T17:15:00Z",
"severity": "HIGH"
},
"details": "VMware ESXi contains an unauthorized access vulnerability due to VMX having access to settingsd authorization tickets. A malicious actor with privileges within the VMX process only, may be able to access settingsd service running as a high privileged user.",
"id": "GHSA-j79m-7c8r-83mc",
"modified": "2022-02-26T00:01:05Z",
"published": "2022-02-17T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22042"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2022-0004.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J7C9-79X7-8HPR
Vulnerability from github – Published: 2025-12-03 16:27 – Updated: 2025-12-20 02:28Summary
An authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.
Details
Step CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.
To create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.
Impact
There is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.
Fix
In v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.
Acknowledgements
This issue was identified and reported by Gabriel Departout and Andy Russon, from AMOSSYS. This audit was sponsored by ANSSI (French Cybersecurity Agency) based on their Open-Source security audit program.
Embargo List
If your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.
Stay safe, and thank you for helping us keep the ecosystem secure.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.28.4"
},
"package": {
"ecosystem": "Go",
"name": "github.com/smallstep/certificates"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.29.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-66406"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-03T16:27:59Z",
"nvd_published_at": "2025-12-03T20:16:26Z",
"severity": "MODERATE"
},
"details": "## Summary\nAn authorized attacker can bypass authorization checks and revoke any SSH certificate issued by Step CA by using a valid revocation token.\n\n## Details\nStep CA users can obtain SSH certificates from a few provisioners. The SSHPOP provisioner allows revocation of the SSH certificate (preventing future certificate renewals) using a token. Due to a missing validity check, this token could be used to revoke any SSH certificate issued by the CA.\n\nTo create a token, an attacker must have access to the CA endpoint and a valid SSH certificate, meaning they were already authorized to obtain an SSH certificate. The attacker must also know the serial number of the certificate they want to revoke.\n\n## Impact\nThere is no way to mitigate this attack. It is recommended to update to v0.29.0 or newer.\n\n## Fix\nIn v0.29.0, the token validation logic was strengthened to bind each token to a specific SSH certificate serial number.\n\n## Acknowledgements\nThis issue was identified and reported by Gabriel Departout and Andy Russon, from [AMOSSYS](http://amossys.fr/). This audit was sponsored by [ANSSI](https://cyber.gouv.fr/) (French Cybersecurity Agency) based on [their Open-Source security audit program](https://cyber.gouv.fr/open-source-lanssi#:~:text=Financement%20d%27%C3%A9valuations%20de%20s%C3%A9curit%C3%A9%20de%20logiciels%20libres).\n\n## Embargo List\n\nIf your organization runs Step CA in production and would like advance, embargoed notification of future security updates, visit https://u.step.sm/disclosure to request inclusion on our embargo list.\n\nStay safe, and thank you for helping us keep the ecosystem secure.",
"id": "GHSA-j7c9-79x7-8hpr",
"modified": "2025-12-20T02:28:23Z",
"published": "2025-12-03T16:27:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/smallstep/certificates/security/advisories/GHSA-j7c9-79x7-8hpr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66406"
},
{
"type": "PACKAGE",
"url": "https://github.com/smallstep/certificates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
],
"summary": "step-ca Has Improper Authorization Check for SSH Certificate Revocation"
}
GHSA-J7CG-X2C3-V6HF
Vulnerability from github – Published: 2025-01-09 21:31 – Updated: 2025-01-10 21:31Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
{
"affected": [],
"aliases": [
"CVE-2024-13291"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-09T21:15:26Z",
"severity": "HIGH"
},
"details": "Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.",
"id": "GHSA-j7cg-x2c3-v6hf",
"modified": "2025-01-10T21:31:27Z",
"published": "2025-01-09T21:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13291"
},
{
"type": "WEB",
"url": "https://www.drupal.org/sa-contrib-2024-057"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-J7G9-PJ98-M5M7
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Message Service: versions 8.5.1 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.5.1 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.5.1 and below.
{
"affected": [],
"aliases": [
"CVE-2021-28821"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-23T21:15:00Z",
"severity": "HIGH"
},
"details": "The Windows Installation component of TIBCO Software Inc.\u0027s TIBCO Enterprise Message Service, TIBCO Enterprise Message Service - Community Edition, and TIBCO Enterprise Message Service - Developer Edition contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.\u0027s TIBCO Enterprise Message Service: versions 8.5.1 and below, TIBCO Enterprise Message Service - Community Edition: versions 8.5.1 and below, and TIBCO Enterprise Message Service - Developer Edition: versions 8.5.1 and below.",
"id": "GHSA-j7g9-pj98-m5m7",
"modified": "2022-05-24T17:45:06Z",
"published": "2022-05-24T17:45:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28821"
},
{
"type": "WEB",
"url": "http://www.tibco.com/services/support/advisories"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J7M5-Q9G3-5Q68
Vulnerability from github – Published: 2025-07-11 18:30 – Updated: 2025-07-11 18:30An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the
Juniper Web Device Manager
(J-Web).
When Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces. This issue affects Junos OS:
- all versions before 21.4R3-S9,
- 22.2 versions before 22.2R3-S5,
- 22.4 versions before 22.4R3-S5,
- 23.2 versions before 23.2R2-S3,
- 23.4 versions before 23.4R2-S5,
- 24.2 versions before 24.2R2.
{
"affected": [],
"aliases": [
"CVE-2025-6549"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-11T16:15:26Z",
"severity": "MODERATE"
},
"details": "An Incorrect Authorization vulnerability in the web server of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to reach the \n\nJuniper Web Device Manager\n\n (J-Web).\n\nWhen Juniper Secure connect (JSC) is enabled on specific interfaces, or multiple interfaces are configured for J-Web, the J-Web UI is reachable over more than the intended interfaces.\nThis issue affects Junos OS:\n\n\n\n * all versions before 21.4R3-S9,\n * 22.2 versions before 22.2R3-S5,\n * 22.4 versions before 22.4R3-S5,\n * 23.2 versions before 23.2R2-S3,\n * 23.4 versions before 23.4R2-S5,\n * 24.2 versions before 24.2R2.",
"id": "GHSA-j7m5-q9g3-5q68",
"modified": "2025-07-11T18:30:34Z",
"published": "2025-07-11T18:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6549"
},
{
"type": "WEB",
"url": "https://supportportal.juniper.net/JSA100098"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:X/RE:M/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-J7VQ-GW7G-J543
Vulnerability from github – Published: 2021-12-15 00:00 – Updated: 2022-07-13 00:01The Spotfire Server component of TIBCO Software Inc.'s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.
{
"affected": [],
"aliases": [
"CVE-2021-43051"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-14T20:15:00Z",
"severity": "HIGH"
},
"details": "The Spotfire Server component of TIBCO Software Inc.\u0027s TIBCO Spotfire Server, TIBCO Spotfire Server, and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows malicious custom API clients with network access to execute internal API operations outside of the scope of those granted to it. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.\u0027s TIBCO Spotfire Server: versions 10.10.6 and below, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, 11.3.0, 11.4.0, and 11.4.1, and TIBCO Spotfire Server: versions 11.5.0 and 11.6.0.",
"id": "GHSA-j7vq-gw7g-j543",
"modified": "2022-07-13T00:01:43Z",
"published": "2021-12-15T00:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43051"
},
{
"type": "WEB",
"url": "https://www.tibco.com/services/support/advisories"
},
{
"type": "WEB",
"url": "https://www.tibco.com/support/advisories/2021/12/tibco-security-advisory-december-14-2021-tibco-spotfire-server-2021-43051"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7VW-HH5C-2W6X
Vulnerability from github – Published: 2026-08-07 15:33 – Updated: 2026-09-09 18:31A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.
{
"affected": [],
"aliases": [
"CVE-2026-37171"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T14:16:59Z",
"severity": "MODERATE"
},
"details": "A lack of tenant separation in SuperTokens Inc. SuperTokens Core v6.0.0 to v11.4.0 allows an authenticated party in one tenant to access sessions, data, and endpoints of another tenant.",
"id": "GHSA-j7vw-hh5c-2w6x",
"modified": "2026-09-09T18:31:04Z",
"published": "2026-08-07T15:33:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37171"
},
{
"type": "WEB",
"url": "https://whitenbaker.com/supertokens-core-multitenant-advisory"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/09/09/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-J7WH-X834-P3R7
Vulnerability from github – Published: 2026-03-16 20:44 – Updated: 2026-03-30 14:00Summary
SiYuan Note v3.6.0 (and likely prior versions) contains an authorization bypass vulnerability in the /api/search/fullTextSearchBlock endpoint. When the method parameter is set to 2, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database without any authorization or read-only checks. This allows any authenticated user — including those with the Reader role — to execute arbitrary SQL statements (SELECT, DELETE, UPDATE, DROP TABLE, etc.) against the application's database.
This is inconsistent with the application's own security model: the dedicated SQL endpoint (/api/query/sql) correctly requires both CheckAdminRole and CheckReadonly middleware, but the search endpoint bypasses these controls entirely.
Root Cause Analysis
The Vulnerable Endpoint
File: kernel/api/router.go, line 188
ginServer.Handle("POST", "/api/search/fullTextSearchBlock", model.CheckAuth, fullTextSearchBlock)
This endpoint only applies model.CheckAuth, which permits any authenticated role (Administrator, Editor, or Reader).
The Properly Protected Endpoint (for comparison)
File: kernel/api/router.go, line 177
ginServer.Handle("POST", "/api/query/sql", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, SQL)
This endpoint correctly chains CheckAdminRole and CheckReadonly, restricting SQL execution to administrators in read-write mode.
The Vulnerable Code Path
File: kernel/api/search.go, lines 389-411
func fullTextSearchBlock(c *gin.Context) {
// ...
page, pageSize, query, paths, boxes, types, method, orderBy, groupBy := parseSearchBlockArgs(arg)
blocks, matchedBlockCount, matchedRootCount, pageCount, docMode :=
model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)
// ...
}
File: kernel/model/search.go, lines 1205-1206
case 2: // SQL
blocks, matchedBlockCount, matchedRootCount = searchBySQL(query, beforeLen, page, pageSize)
When method=2, the raw query string is passed directly to searchBySQL().
File: kernel/model/search.go, lines 1460-1462
func searchBySQL(stmt string, beforeLen, page, pageSize int) (ret []*Block, ...) {
stmt = strings.TrimSpace(stmt)
blocks := sql.SelectBlocksRawStmt(stmt, page, pageSize)
File: kernel/sql/block_query.go, lines 566-569, 713-714
func SelectBlocksRawStmt(stmt string, page, limit int) (ret []*Block) {
parsedStmt, err := sqlparser.Parse(stmt)
if err != nil {
return selectBlocksRawStmt(stmt, limit) // Falls through to raw execution
}
// ...
}
func selectBlocksRawStmt(stmt string, limit int) (ret []*Block) {
rows, err := query(stmt) // Executes arbitrary SQL
// ...
}
File: kernel/sql/database.go, lines 1327-1337
func query(query string, args ...interface{}) (*sql.Rows, error) {
// ...
return db.Query(query, args...) // Go's database/sql db.Query — executes ANY SQL
}
Go's database/sql db.Query() will execute any SQL statement, including DELETE, UPDATE, DROP TABLE, INSERT, etc. The returned *sql.Rows will simply be empty for non-SELECT statements, but the destructive operation is still executed.
Authorization Model
File: kernel/model/session.go, lines 201-210
func CheckAuth(c *gin.Context) {
// Already authenticated via JWT
if role := GetGinContextRole(c); IsValidRole(role, []Role{
RoleAdministrator,
RoleEditor,
RoleReader, // <-- Reader role passes CheckAuth
}) {
c.Next()
return
}
// ...
}
File: kernel/model/session.go, lines 380-386
func CheckAdminRole(c *gin.Context) {
if IsAdminRoleContext(c) {
c.Next()
} else {
c.AbortWithStatus(http.StatusForbidden) // <-- This check is MISSING on the search endpoint
}
}
Proof of Concept
Prerequisites
- SiYuan instance accessible over the network (e.g., Docker deployment)
- Valid authentication as any user role (including
Reader)
Steps to Reproduce
-
Authenticate to SiYuan and obtain a valid session cookie or API token.
-
Read all data (confidentiality breach):
curl -X POST http://<target>:6806/api/search/fullTextSearchBlock \
-H "Content-Type: application/json" \
-H "Authorization: Token <reader_token>" \
-d '{"method": 2, "query": "SELECT * FROM blocks LIMIT 100"}'
- Delete all blocks (integrity/availability breach):
curl -X POST http://<target>:6806/api/search/fullTextSearchBlock \
-H "Content-Type: application/json" \
-H "Authorization: Token <reader_token>" \
-d '{"method": 2, "query": "DELETE FROM blocks"}'
- Drop tables (availability breach):
curl -X POST http://<target>:6806/api/search/fullTextSearchBlock \
-H "Content-Type: application/json" \
-H "Authorization: Token <reader_token>" \
-d '{"method": 2, "query": "DROP TABLE blocks"}'
- Compare with the properly protected endpoint (should return HTTP 403 for Reader role):
curl -X POST http://<target>:6806/api/query/sql \
-H "Content-Type: application/json" \
-H "Authorization: Token <reader_token>" \
-d '{"stmt": "SELECT * FROM blocks LIMIT 10"}'
Expected Behavior
The search endpoint should reject SQL execution for non-admin users, or at minimum enforce read-only access, consistent with /api/query/sql.
Actual Behavior
Any authenticated user (including Reader role) can execute arbitrary SQL including destructive operations.
Impact
In a multi-user deployment (e.g., Docker with published access, or any network-accessible instance with access authorization code):
- Confidentiality: A Reader-role user can read all data in the SQLite database, including blocks, assets, references, and configuration data they should not have access to.
- Integrity: A Reader-role user can modify or delete any data in the database, despite having read-only access by design.
- Availability: A Reader-role user can drop tables or corrupt the database, rendering the application unusable.
Suggested Fix
Add CheckAdminRole and CheckReadonly middleware to the search endpoint, or add explicit validation that only SELECT statements are accepted when method=2:
Option A — Restrict method=2 to admin (recommended):
In kernel/api/search.go, add a role check when method=2:
func fullTextSearchBlock(c *gin.Context) {
// ...
page, pageSize, query, paths, boxes, types, method, orderBy, groupBy := parseSearchBlockArgs(arg)
// SQL mode requires admin privileges, consistent with /api/query/sql
if method == 2 && !model.IsAdminRoleContext(c) {
ret.Code = -1
ret.Msg = "SQL search requires administrator privileges"
return
}
// ...
}
Option B — Enforce SELECT-only for non-admin users:
Validate the parsed SQL to ensure only SELECT statements are executed when the user is not an administrator.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/siyuan-note/siyuan/kernel"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.0.0-20260313024916-fd6526133bb3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32767"
],
"database_specific": {
"cwe_ids": [
"CWE-863",
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T20:44:52Z",
"nvd_published_at": "2026-03-20T01:15:55Z",
"severity": "CRITICAL"
},
"details": "## Summary\n\nSiYuan Note v3.6.0 (and likely prior versions) contains an authorization bypass vulnerability in the `/api/search/fullTextSearchBlock` endpoint. When the `method` parameter is set to `2`, the endpoint passes user-supplied input directly as a raw SQL statement to the underlying SQLite database without any authorization or read-only checks. This allows any authenticated user \u2014 including those with the `Reader` role \u2014 to execute arbitrary SQL statements (SELECT, DELETE, UPDATE, DROP TABLE, etc.) against the application\u0027s database.\n\nThis is inconsistent with the application\u0027s own security model: the dedicated SQL endpoint (`/api/query/sql`) correctly requires both `CheckAdminRole` and `CheckReadonly` middleware, but the search endpoint bypasses these controls entirely.\n\n## Root Cause Analysis\n\n### The Vulnerable Endpoint\n\n**File:** `kernel/api/router.go`, line 188\n\n```go\nginServer.Handle(\"POST\", \"/api/search/fullTextSearchBlock\", model.CheckAuth, fullTextSearchBlock)\n```\n\nThis endpoint only applies `model.CheckAuth`, which permits **any** authenticated role (Administrator, Editor, or Reader).\n\n### The Properly Protected Endpoint (for comparison)\n\n**File:** `kernel/api/router.go`, line 177\n\n```go\nginServer.Handle(\"POST\", \"/api/query/sql\", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, SQL)\n```\n\nThis endpoint correctly chains `CheckAdminRole` and `CheckReadonly`, restricting SQL execution to administrators in read-write mode.\n\n### The Vulnerable Code Path\n\n**File:** `kernel/api/search.go`, lines 389-411\n\n```go\nfunc fullTextSearchBlock(c *gin.Context) {\n // ...\n page, pageSize, query, paths, boxes, types, method, orderBy, groupBy := parseSearchBlockArgs(arg)\n blocks, matchedBlockCount, matchedRootCount, pageCount, docMode :=\n model.FullTextSearchBlock(query, boxes, paths, types, method, orderBy, groupBy, page, pageSize)\n // ...\n}\n```\n\n**File:** `kernel/model/search.go`, lines 1205-1206\n\n```go\ncase 2: // SQL\n blocks, matchedBlockCount, matchedRootCount = searchBySQL(query, beforeLen, page, pageSize)\n```\n\nWhen `method=2`, the raw `query` string is passed directly to `searchBySQL()`.\n\n**File:** `kernel/model/search.go`, lines 1460-1462\n\n```go\nfunc searchBySQL(stmt string, beforeLen, page, pageSize int) (ret []*Block, ...) {\n stmt = strings.TrimSpace(stmt)\n blocks := sql.SelectBlocksRawStmt(stmt, page, pageSize)\n```\n\n**File:** `kernel/sql/block_query.go`, lines 566-569, 713-714\n\n```go\nfunc SelectBlocksRawStmt(stmt string, page, limit int) (ret []*Block) {\n parsedStmt, err := sqlparser.Parse(stmt)\n if err != nil {\n return selectBlocksRawStmt(stmt, limit) // Falls through to raw execution\n }\n // ...\n}\n\nfunc selectBlocksRawStmt(stmt string, limit int) (ret []*Block) {\n rows, err := query(stmt) // Executes arbitrary SQL\n // ...\n}\n```\n\n**File:** `kernel/sql/database.go`, lines 1327-1337\n\n```go\nfunc query(query string, args ...interface{}) (*sql.Rows, error) {\n // ...\n return db.Query(query, args...) // Go\u0027s database/sql db.Query \u2014 executes ANY SQL\n}\n```\n\nGo\u0027s `database/sql` `db.Query()` will execute any SQL statement, including `DELETE`, `UPDATE`, `DROP TABLE`, `INSERT`, etc. The returned `*sql.Rows` will simply be empty for non-SELECT statements, but the destructive operation is still executed.\n\n### Authorization Model\n\n**File:** `kernel/model/session.go`, lines 201-210\n\n```go\nfunc CheckAuth(c *gin.Context) {\n // Already authenticated via JWT\n if role := GetGinContextRole(c); IsValidRole(role, []Role{\n RoleAdministrator,\n RoleEditor,\n RoleReader, // \u003c-- Reader role passes CheckAuth\n }) {\n c.Next()\n return\n }\n // ...\n}\n```\n\n**File:** `kernel/model/session.go`, lines 380-386\n\n```go\nfunc CheckAdminRole(c *gin.Context) {\n if IsAdminRoleContext(c) {\n c.Next()\n } else {\n c.AbortWithStatus(http.StatusForbidden) // \u003c-- This check is MISSING on the search endpoint\n }\n}\n```\n\n## Proof of Concept\n\n### Prerequisites\n- SiYuan instance accessible over the network (e.g., Docker deployment)\n- Valid authentication as any user role (including `Reader`)\n\n### Steps to Reproduce\n\n1. Authenticate to SiYuan and obtain a valid session cookie or API token.\n\n2. **Read all data (confidentiality breach):**\n```bash\ncurl -X POST http://\u003ctarget\u003e:6806/api/search/fullTextSearchBlock \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Token \u003creader_token\u003e\" \\\n -d \u0027{\"method\": 2, \"query\": \"SELECT * FROM blocks LIMIT 100\"}\u0027\n```\n\n3. **Delete all blocks (integrity/availability breach):**\n```bash\ncurl -X POST http://\u003ctarget\u003e:6806/api/search/fullTextSearchBlock \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Token \u003creader_token\u003e\" \\\n -d \u0027{\"method\": 2, \"query\": \"DELETE FROM blocks\"}\u0027\n```\n\n4. **Drop tables (availability breach):**\n```bash\ncurl -X POST http://\u003ctarget\u003e:6806/api/search/fullTextSearchBlock \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Token \u003creader_token\u003e\" \\\n -d \u0027{\"method\": 2, \"query\": \"DROP TABLE blocks\"}\u0027\n```\n\n5. **Compare with the properly protected endpoint** (should return HTTP 403 for Reader role):\n```bash\ncurl -X POST http://\u003ctarget\u003e:6806/api/query/sql \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Token \u003creader_token\u003e\" \\\n -d \u0027{\"stmt\": \"SELECT * FROM blocks LIMIT 10\"}\u0027\n```\n\n### Expected Behavior\nThe search endpoint should reject SQL execution for non-admin users, or at minimum enforce read-only access, consistent with `/api/query/sql`.\n\n### Actual Behavior\nAny authenticated user (including Reader role) can execute arbitrary SQL including destructive operations.\n\n## Impact\n\nIn a multi-user deployment (e.g., Docker with published access, or any network-accessible instance with access authorization code):\n\n- **Confidentiality:** A Reader-role user can read all data in the SQLite database, including blocks, assets, references, and configuration data they should not have access to.\n- **Integrity:** A Reader-role user can modify or delete any data in the database, despite having read-only access by design.\n- **Availability:** A Reader-role user can drop tables or corrupt the database, rendering the application unusable.\n\n## Suggested Fix\n\nAdd `CheckAdminRole` and `CheckReadonly` middleware to the search endpoint, or add explicit validation that only SELECT statements are accepted when `method=2`:\n\n**Option A \u2014 Restrict method=2 to admin (recommended):**\n\nIn `kernel/api/search.go`, add a role check when `method=2`:\n\n```go\nfunc fullTextSearchBlock(c *gin.Context) {\n // ...\n page, pageSize, query, paths, boxes, types, method, orderBy, groupBy := parseSearchBlockArgs(arg)\n\n // SQL mode requires admin privileges, consistent with /api/query/sql\n if method == 2 \u0026\u0026 !model.IsAdminRoleContext(c) {\n ret.Code = -1\n ret.Msg = \"SQL search requires administrator privileges\"\n return\n }\n // ...\n}\n```\n\n**Option B \u2014 Enforce SELECT-only for non-admin users:**\n\nValidate the parsed SQL to ensure only SELECT statements are executed when the user is not an administrator.",
"id": "GHSA-j7wh-x834-p3r7",
"modified": "2026-03-30T14:00:31Z",
"published": "2026-03-16T20:44:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-j7wh-x834-p3r7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32767"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/issues/17209"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/commit/d5e2d0bce0dffef5f61bd8066954bc2d41181fc5"
},
{
"type": "PACKAGE",
"url": "https://github.com/siyuan-note/siyuan"
},
{
"type": "WEB",
"url": "https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SiYuan: Authorization Bypass Allows Arbitrary SQL Execution via Search API"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.