CVE-2026-29073 is a vulnerability in the SiYuan personal knowledge management system, specifically in versions before 3.6.0. The flaw exists in the /api/query/sql API endpoint, which permits SQL query execution by any authenticated user without verifying if the user has administrative privileges. The system only performs basic authentication checks but fails to enforce authorization, allowing users with minimal privileges, such as readers, to run arbitrary SQL commands directly on the backend database. This missing authorization (CWE-862) combined with the ability to execute SQL queries (CWE-89) can lead to unauthorized data disclosure, data modification, or potentially full database compromise. The vulnerability is remotely exploitable over the network without requiring user interaction or elevated privileges beyond authentication. The CVSS 4.0 base score is 5.7 (medium severity), reflecting the moderate impact and ease of exploitation. The issue was publicly disclosed on March 6, 2026, and has been fixed in SiYuan version 3.6.0. No known active exploits have been reported, but the vulnerability poses a significant risk to any deployment running outdated versions.

The vulnerability allows any authenticated user, including those with read-only access, to execute arbitrary SQL queries on the SiYuan database. This can lead to unauthorized access to sensitive information, data tampering, or deletion, compromising the confidentiality, integrity, and availability of the data stored within SiYuan. For organizations relying on SiYuan for knowledge management, this could result in data breaches, loss of intellectual property, or disruption of business operations. Since the flaw does not require administrative privileges or user interaction, it lowers the barrier for exploitation by insiders or attackers who have gained basic user credentials. The impact is particularly critical in environments where SiYuan stores sensitive or proprietary information. Although no exploits are currently known in the wild, the vulnerability's presence in a network-exposed API endpoint increases the risk of future exploitation attempts.

Organizations should immediately upgrade SiYuan to version 3.6.0 or later, where this vulnerability is patched. Until upgrading is possible, restrict access to the /api/query/sql endpoint by implementing network-level controls such as IP whitelisting or VPN access to limit users who can authenticate. Review and enforce strict authentication and authorization policies to ensure users have only the minimum necessary privileges. Monitor logs for unusual SQL query activity or access patterns that could indicate exploitation attempts. Consider deploying Web Application Firewalls (WAFs) with custom rules to detect and block unauthorized SQL queries targeting this endpoint. Additionally, conduct regular security audits and penetration testing focused on API endpoints to identify similar authorization weaknesses proactively.