VulnSocial

CVE-2026-69084Disclosure

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no single-statement, read-only, or admin restrictions. The endpoint is gated only by CheckAuth, making it reachable by the publish RoleReader token and by anonymous users when publish authentication is disabled. Because the underlying driver executes stacked statements, an attacker can read and modify content across all opened cleartext notebooks (encrypted per-box notebooks are excluded). Fixed in v3.7.3.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 4 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-08-18); latest day: 1
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-08-04: 1Mentions · 2026-08-18: 2Mentions · 2026-09-04: 1Patch / Workaround · 2026-08-04: 1Technical Details · 2026-08-04: 1Technical Details · 2026-08-18: 2Technical Details · 2026-09-04: 108-0408-1809-04
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-08-041
Patch1
2026-08-182
Disclosure2
2026-09-041
Disclosure1
Full discourse4 posts
  • SECNORA®@secnorainfosec
    Disclosure

    🚨 CVE-2026-69084: Unauthenticated Arbitrary SQL Execution via searchEmbedBlock With a CVSS score of 10.0 (Critical), the endpoint ran raw SQL without enforcing admin authorization or read-only database restrictions. 🔗Read the full technical breakdown: https://secnora.com/blog/cve-2026-69084/

    Post summary

    The post announces CVE-2026-69084, a critical unauthenticated SQL injection flaw, and provides a link to a detailed technical analysis, but no PoC, exploit code, or patch information.

    0001028
    76 followersView on X
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-69084 - critical 🚨 SiYuan - SQL Execution &gt; SiYuan &lt;= v3.7.2 contains a SQL injection caused by passing client-supplied SQL state... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-69084 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces a critical SQL injection vulnerability (CVE-2026-69084) affecting SiYuan versions <= v3.7.2, providing a brief technical description and a link to a vulnerability library but no exploitation or patch details.

    00001210
    1.2K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Siyuan, SQL Injection (Unauthenticated), #CVE-2026-69084 (Critical) -DC-Sep2026-2171 https://dailycve.com/siyuan-sql-injection-unauthenticated-cve-2026-69084-critical-dc-sep2026-2171/

    Post summary

    The post announces the discovery of CVE-2026-69084, a critical unauthenticated SQL injection vulnerability in Siyuan, but does not provide any exploit code, mitigation, or evidence of active exploitation.

    0000030
    233 followersView on X
  • ThreatAft@ThreatAft
    Patch

    🔐 🚨 SiYuan 4-CVE Bundle — CVSS 10.0 CVE-2026-69084: Unauthenticated SQL injection allows read/write access to all notebooks. Update to 3.7.3 NOW. → http://threataft.com/articles/siyuan-4-cve-bundle-cve-2026-69084 #cybersecurity #infosec #SiYuan #PKM #CVSS10 #ThreatIntel

    Post summary

    The post announces a CVE-2026-69084 SQL injection flaw with CVSS 10.0, urges users to update to version 3.7.3 to mitigate the risk.

    0000045
    36 followersView on X

Explore more

Back to dashboard