CVE-2026-87807 [HIGH] – siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the

siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint’s method=1 query parameter. Attackers can inject UNION SELECT statements to read the entire blocks table, bypassing publish-access controls and exposing all document content and sensitive attributes.