A critical vulnerability (CVE-2026-69084, CVSS 10.0) has been identified in SiYuan note-taking software versions up to v3.7.2. The /api/search/searchEmbedBlock endpoint improperly sanitizes client-supplied SQL statements, permitting stacked SQL execution through the primary read-write database connection. This flaw bypasses standard authentication mechanisms when publish authentication is disabled, enabling anonymous users to read and modify content across all unencrypted notebooks. Attackers can exploit this by crafting malicious SQL payloads to exfiltrate data, alter notes, or escalate privileges. The vulnerability affects all deployments using default authentication configurations or exposing the endpoint to untrusted networks. Encrypted 'per-box' notebooks are not impacted. Users are strongly advised to upgrade to v3.7.3, which implements input validation and statement isolation to mitigate this risk. Organizations leveraging SiYuan for collaborative note-taking or knowledge management should prioritize patching to prevent potential data compromise. No workarounds are available for versions prior to the fix.