CVE-2026-45371 affects SiYuan, an open-source personal knowledge management system, in versions before 3.7.0. Eight POST APIs related to graph data, synchronization settings, document view times, and search embedding updates are protected only by a basic authentication check (model.CheckAuth) but lack enforcement of admin or readonly roles. This allows any caller with a valid JWT passing CheckAuth—including anonymous publish-service Reader roles and Editors in readonly workspaces—to perform unauthorized writes to server-side state, including atomic overwrites of the workspace configuration file conf.json. The vulnerability is fixed in SiYuan 3.7.0.

An attacker or unauthorized user with a valid JWT token that passes basic authentication can modify critical server-side configuration and SQL index data. This could lead to unauthorized changes in application behavior or data integrity issues. The CVSS 4.0 score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no user interaction, and high impact on integrity and availability.

Upgrade SiYuan to version 3.7.0 or later, where this improper authorization vulnerability has been fixed. Until then, restrict access to the affected APIs to trusted users only and avoid exposing publish-mode Reader roles to untrusted parties. Patch status is not explicitly confirmed in the advisory, but the vendor fixed the issue in version 3.7.0.