# CVE-2026-100642: SiYuan cross-site request forgery in CheckAuth lock-screen bypass

Source: https://junglewise.ai/threats/cve-2026-100642-siyuan-versions-from-v2-1-0-before-v3-8-4-contain-a-cross-site  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100642 · Severity: high · CVSS 7.6 · Published 2026-09-26

SiYuan is a note-taking and knowledge management application with a kernel HTTP API that can be protected by a lock-screen password. A cross-site request forgery vulnerability allows attackers to craft malicious web pages that, when visited by a victim with an active SiYuan session, can force the kernel to terminate without saving, expose workspace configuration and proxy settings, or execute administrative actions without any credentials. The vulnerability affects versions 2.1.0 through 3.8.3, allowing attackers to completely bypass the lock-screen protection through the victim's own browser.

Technologies: [SiYuan](https://junglewise.ai/threats/technologies/siyuan). Vendors: [SiYuan](https://junglewise.ai/threats/vendors/siyuan).

## Quick answers

**Is CVE-2026-100642 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100642 being exploited in the wild.

**How severe is CVE-2026-100642?** High severity, with a CVSS score of 7.6, published 26 September 2026.

**Which products and versions are affected?** SiYuan >=2.1.0, <3.8.4.

**Is there a fix for CVE-2026-100642?** A patch was published on 2026-09-26: v3.8.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100642 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100642?** Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the CheckAuth function (kernel/model/session.go) where the lock-screen pass-through branch grants RoleAdministrator to any loopback request matching specific URI prefixes (/api/system/exit, /api/system/getNetwork, /api/system/getWorkspaceInfo, /api/system/uiproc, /assets/, /export/) without validating Origin, Host, or Sec-Fetch-Site headers. Unlike sibling authentication branches in the same function, this path incorrectly assumes "loopback source = trusted local initiator" and fails to account for browser-initiated cross-origin requests that appear as loopback traffic (127.0.0.1). The affected endpoints respond with Access-Control-Allow-Origin: * or no CORS restriction, allowing the attacker's page to read responses; no user interaction beyond visiting a malicious page is required, and the attack succeeds with zero credentials.

## Affected products

- SiYuan SiYuan >=2.1.0, <3.8.4

## Timeline

- 2026-09-10: disclosed
- 2026-09-26: advisory
- 2026-09-26: patched: v3.8.4 released

## References

- [https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m](https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m)
- [https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.4-cross-site-request-forgery-via-checkauth](https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.4-cross-site-request-forgery-via-checkauth)

## Related threats

- [SiYuan path traversal in web fetch](https://junglewise.ai/threats/cve-2026-126776-siyuan-3-7-0-before-3-8-10-on-windows-contains-a-path-traversal)
- [SiYuan publish filter information disclosure in local storage](https://junglewise.ai/threats/go-2026-6836-siyuan-the-publish-filter-for-local-storage-returns-the-7f022e62)
- [SiYuan path traversal via GLOBALROOT alias bypass](https://junglewise.ai/threats/cve-2026-118680-siyuan-3-8-7-through-3-8-8-fails-to-normalize-windows-globalroot)
- [SiYuan SQL injection in history search](https://junglewise.ai/threats/cve-2026-116170-siyuan-before-v3-8-7-contains-an-sql-injection-vulnerability)
- [SiYuan cross-site scripting in /check-auth redirect](https://junglewise.ai/threats/cve-2026-116167-siyuan-from-2-9-0-before-3-8-7-contains-a-cross-site-scripting)