Home / Vulnerability Intelligence / CVE-2026-32767

CVE-2026-32767 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 20, 2026

SiYuan - Authorization Bypass & SQL Injection

Published: March 20, 2026Updated: March 20, 2026Remote Exploitable

Overview

SiYuan <= 3.6.0 contains an authorization bypass caused by improper authorization checks in /api/search/fullTextSearchBlock endpoint allowing authenticated users to execute arbitrary SQL statements, exploit requires authentication.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Authenticated users can execute arbitrary SQL commands, potentially leading to data modification or deletion and full database compromise.

Mitigation

Upgrade to version 3.6.1 or later.

References

Social Media Activity(2 posts)

Offensive Sequence

@offseq

Mar 20, 2026

⚠️ CVE-2026-32767: SiYuan (<3.6.1) has a CRITICAL SQL injection flaw in /api/search/fullTextSearchBlock. Any authenticated user can run SQL, risking full data compromise. Upgrade to 3.6.1+ ASAP. https://radar.offseq.com/threat/cve-2026-32767-cwe-89-improper-neutralization-of-s-8a5766fd #OffSeq #SiYuan #SQLInjection #Vuln

View original post

Offensive Sequence

@offseq

Mar 20, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-32767
Severity: Critical
CVSS Score: 9.8
Type: sql_injection
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-89

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days