CVE-2026-29073
Published: 06 March 2026
Summary
CVE-2026-29073 is a high-severity SQL Injection (CWE-89) vulnerability in B3Log Siyuan. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations on the /api/query/sql endpoint to restrict SQL execution to admin users only, directly addressing the missing authorization vulnerability.
Applies least privilege to ensure reader-only users cannot access or execute arbitrary SQL queries on the database.
Defines separation of duties between reader and admin roles to prevent low-privileged users from performing high-impact database operations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization on /api/query/sql directly enables remote exploitation of the public-facing app (T1190) by low-priv users, granting arbitrary SQL read/write/delete on the notes database. This facilitates data exfiltration from local system/DB repositories (T1005, T1213.006), stored data manipulation (T1565.001), and data destruction (T1485).
NVD Description
SiYuan is a personal knowledge management system. Prior to version 3.6.0, the /api/query/sql lets a user run sql directly, but it only checks basic auth, not admin rights, any logged-in user, even readers, can run any sql query on the…
more
database. This issue has been patched in version 3.6.0.
Deeper analysisAI
CVE-2026-29073 is a missing authorization vulnerability in SiYuan, a personal knowledge management system, affecting versions prior to 3.6.0. The /api/query/sql endpoint permits users to execute arbitrary SQL queries directly on the database but only enforces basic authentication, without checking for admin privileges. This allows any authenticated user, including those with reader-only access, to perform unrestricted database operations, mapped to CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) and CWE-862 (Missing Authorization).
The vulnerability can be exploited remotely (AV:N) by any low-privileged authenticated user (PR:L) with low attack complexity (AC:L) and no user interaction (UI:N), maintaining unchanged scope (S:U). Attackers achieve high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), enabling full database read, write, or delete access, such as exfiltrating sensitive notes, altering data, or disrupting service. The CVSS v3.1 base score is 8.8, indicating high severity.
The vulnerability has been patched in SiYuan version 3.6.0. Additional mitigation guidance is available in the GitHub Security Advisory at https://github.com/siyuan-note/siyuan/security/advisories/GHSA-jqwg-75qf-vmf9.
Details
- CWE(s)