Executive brief
SiYuan is a note-taking and knowledge management application with a kernel HTTP API that can be protected by a lock-screen password. A cross-site request forgery vulnerability allows attackers to craft malicious web pages that, when visited by a victim with an active SiYuan session, can force the kernel to terminate without saving, expose workspace configuration and proxy settings, or execute administrative actions without any credentials. The vulnerability affects versions 2.1.0 through 3.8.3, allowing attackers to completely bypass the lock-screen protection through the victim's own browser.
Technical details
The vulnerability exists in the CheckAuth function (kernel/model/session.go) where the lock-screen pass-through branch grants RoleAdministrator to any loopback request matching specific URI prefixes (/api/system/exit, /api/system/getNetwork, /api/system/getWorkspaceInfo, /api/system/uiproc, /assets/, /export/) without validating Origin, Host, or Sec-Fetch-Site headers. Unlike sibling authentication branches in the same function, this path incorrectly assumes "loopback source = trusted local initiator" and fails to account for browser-initiated cross-origin requests that appear as loopback traffic (127.0.0.1). The affected endpoints respond with Access-Control-Allow-Origin: * or no CORS restriction, allowing the attacker's page to read responses; no user interaction beyond visiting a malicious page is required, and the attack succeeds with zero credentials.
Affected products
- SiYuan SiYuan >=2.1.0, <3.8.4
Timeline
- 2026-09-10: disclosed
- 2026-09-26: advisory
- 2026-09-26: patched: v3.8.4 released