A privilege escalation vulnerability in SiYuan Note allows low-privilege users to modify notebook content, posing a significant risk to data integrity.

This is an improper access control flaw (CWE-284/CWE-862) occurring in the /api/block/appendHeadingChildren endpoint. The application fails to enforce administrative authorization, allowing authenticated users with RoleReader privileges to perform unauthorized write operations.

The ability for unauthorized users to append or modify notebook content compromises the integrity of sensitive knowledge management data. Given the CVSS score of 7.1, this vulnerability is classified as High severity, as it enables authenticated attackers to bypass intended access restrictions and manipulate organizational or personal documentation.

Immediate Action: Update SiYuan Note to version 3.5.10 or later to ensure the proper authorization checks are enforced on the vulnerable API endpoint.

Proactive Monitoring: Review audit logs for unusual activity on the /api/block/appendHeadingChildren endpoint, specifically looking for write requests originating from accounts with RoleReader permissions.

Compensating Controls: If immediate patching is not feasible, restrict access to the publish service for untrusted accounts or implement network-level controls to limit exposure of the API endpoints.

Public Exploit Available: No (exploit_available unknown).

This vulnerability presents a clear risk to data integrity within the SiYuan Note environment. Administrators must prioritize updating to version 3.5.10 immediately to remediate the authorization flaw and prevent potential unauthorized modification of stored notebooks.