CVE-2026-69083 AKAOMA CVE VULNERABILITIES / 22h SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

Back cve.akaoma.com

CVE-2026-69083 AKAOMA CVE VULNERABILITIES / 22h SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.

cve.akaoma.com • August 4, 2026

Share: View original

10.0 /10 Critical Risk As a catastrophic security flaw, CVE-2026-69083 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-69083 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability Discovered in SiYuan Software A critical SQL injection vulnerability, designated CVE-2026-69083, has been identified in SiYuan versions prior to v3.7.3. This flaw affects the fullTextSearchAssetContent endpoint, allowing unauthenticated users and those with publish RoleReader tokens to execute arbitrary SQL commands. Attackers can manipulate unescaped method parameters and REGEXP clauses to read, modify, or delete data across notebooks in the asset-content database. Currently, there is no evidence of public exploitation or proof-of-concept code. Users are advised to upgrade to version 3.7.3 or later immediately. If upgrading is not feasible, restricting network access to the vulnerable endpoint and auditing access logs for suspicious activity is recommended. The vulnerability has been assigned a CVSS score of 4.0, indicating a high severity level. 4 sources 72

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Cwe-89 - SQL Injection

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application