CVE-2026-45371 is an improper authorization vulnerability in SiYuan (an open-source personal knowledge management system) versions before 3.7.0. Eight POST APIs related to graph data, sync intervals, document view times, and search embedding are protected only by a basic authentication check (model.CheckAuth) but omit more restrictive checks like model.CheckAdminRole and model.CheckReadonly. Consequently, users with a RoleReader in publish mode or RoleEditor with readonly workspace permissions can invoke these APIs to mutate server-side state, including atomic rewrites of the workspace configuration file conf.json. This vulnerability allows unauthorized state changes by roles that should have limited or no write permissions. The vulnerability is resolved in SiYuan 3.7.0.

Attackers or unauthorized users with a JWT passing the basic authentication check can modify critical server-side configuration and SQL index data. This can lead to unauthorized changes in workspace settings and potentially disrupt normal operation or data integrity. The vulnerability affects all SiYuan instances running versions earlier than 3.7.0. There are no known exploits in the wild at this time.

Upgrade SiYuan to version 3.7.0 or later, where this improper authorization vulnerability is fixed. Since no official patch or temporary fix is documented beyond this version upgrade, applying the update is the recommended remediation. Patch status is not explicitly confirmed beyond the version fix note; verify with the vendor advisory for any additional guidance.