CVE-2026-59853

Executive Summary

CVE-2026-59853 is an authorization bypass vulnerability in SiYuan, an open-source personal knowledge management system. The flaw resides in the /api/storage/getCriteria endpoint, which fails to enforce the same publish-access filtering used by sibling storage endpoints. This allows an authenticated user with Reader privileges in publish mode to read sensitive internal data, including private document paths, notebook IDs, document IDs, block IDs, and search/replace keywords for unpublished documents. The vulnerability has a CVSS score of 6.5 (Medium) and is fixed in version 3.7.1.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit.
• Privileges Required (PR): Low (L) – An attacker needs a valid Reader account in publish mode.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Sensitive internal data is exposed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. While the CVSS score is 6.5, the exposure of internal document metadata and search keywords could lead to further targeted attacks or data leaks.

Deep Dive & Mechanics

The vulnerability exists because the /api/storage/getCriteria endpoint reads saved search criteria from data/storage/criteria.json without applying the same publish-access filtering that other storage endpoints use. In SiYuan's publish mode, Reader accounts are intended to have restricted access to only published content. However, this endpoint bypasses that restriction, allowing a Reader to enumerate:

• Private document paths
• Notebook, document, and block IDs
• Search and replace keywords for unpublished documents

The root cause is a missing authorization check in the server-side code that handles the getCriteria API call. The fix in version 3.7.1 adds the necessary filtering to ensure that only published content is accessible via this endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 3.7.1): The endpoint directly reads and returns the contents of criteria.json without checking the user's publish access level.

// Vulnerable endpoint handler
app.get('/api/storage/getCriteria', (req, res) => {
    const criteria = fs.readFileSync('data/storage/criteria.json', 'utf8');
    res.json(JSON.parse(criteria));
});

Patched Code (3.7.1+): The patched version adds a check to ensure the user has appropriate publish access before returning the criteria data.

// Patched endpoint handler
app.get('/api/storage/getCriteria', (req, res) => {
    if (!req.user.hasPublishAccess()) {
        return res.status(403).json({ error: 'Forbidden' });
    }
    const criteria = fs.readFileSync('data/storage/criteria.json', 'utf8');
    res.json(JSON.parse(criteria));
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Reader account in publish mode on a SiYuan instance running version < 3.7.1.
• Network access to the SiYuan API endpoint.

Exploitation Steps:

1. Authenticate as a Reader user and obtain a session token.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET "https://target.siyuan.example/api/storage/getCriteria" \
        -H "Authorization: Bearer <reader_token>"
   

3. Parse the response to extract sensitive data such as document paths, IDs, and search keywords.

Expected Output:

{
  "criteria": [
    {
      "name": "Private Search",
      "query": "confidential",
      "notebookId": "20240101120000-abc123",
      "documentId": "20240101120000-def456",
      "blockId": "20240101120000-ghi789"
    }
  ]
}

Blue Team

Detection:

• Monitor for unusual access to /api/storage/getCriteria from Reader accounts.
• Alert on multiple rapid requests to this endpoint from the same user.
• Correlate with other storage endpoint access patterns to identify anomalies.

Hunting:

• Search logs for GET /api/storage/getCriteria requests with HTTP 200 responses.
• Review user activity for Reader accounts accessing this endpoint.
• Check for large volumes of data being exfiltrated via this endpoint.

Prevention:

• Apply the patch by upgrading to SiYuan version 3.7.1 or later.
• Implement additional network segmentation to restrict API access.
• Use a Web Application Firewall (WAF) to block suspicious requests.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /api/storage/getCriteria from Reader accounts.
  • Unusual outbound data transfers containing JSON with notebookId, documentId, or blockId fields.
• File:
  • Unauthorized reads of data/storage/criteria.json on the server.
• Logs:
  • Repeated 200 responses to /api/storage/getCriteria from the same user.
  • Access logs showing Reader accounts hitting this endpoint.

Detection Engineering

YARA Rule

rule CVE_2026_59853_SiYuan_GetCriteria {
    meta:
        description = "Detects exploitation attempts of CVE-2026-59853 in SiYuan"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59853"
    strings:
        $s1 = "/api/storage/getCriteria" ascii wide nocase
        $s2 = "criteria.json" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-59853 - SiYuan GetCriteria Endpoint Access
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to the vulnerable /api/storage/getCriteria endpoint in SiYuan
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/storage/getCriteria'
    condition: selection
falsepositives:
    - Legitimate admin access after patch
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-59853 - SiYuan GetCriteria Endpoint Exploit"; flow:to_server; content:"GET"; http_method; content:"/api/storage/getCriteria"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade SiYuan to version 3.7.1 or later.
2. If immediate upgrade is not possible, restrict access to the /api/storage/getCriteria endpoint using a reverse proxy or WAF.
3. Review and rotate any credentials or tokens that may have been exposed.

Long-term:

1. Implement regular security audits of API endpoints for authorization bypasses.
2. Adopt a least-privilege model for all API access.
3. Enable comprehensive logging and monitoring for all storage-related endpoints.

Workaround:

• Block the /api/storage/getCriteria endpoint at the network level until the patch can be applied.

Valters IT