Executive brief
SiYuan, a personal knowledge management system, contains a critical security flaw in its kernel's Model Context Protocol (MCP) endpoint. When the 'Publish' feature is enabled in anonymous mode to share notes publicly, the system inadvertently grants unauthenticated remote users administrative-level access to the workspace. An attacker can exploit this to steal sensitive configuration data, modify or delete any file in the user's workspace, and gain full control over the host system by planting malicious plugins.
Technical details
A missing authorization check (CWE-862) exists in the POST /mcp endpoint of the SiYuan kernel. While the endpoint is gated by a general authentication check, it lacks specific administrative or read-only role enforcement. When the Publish server is enabled in anonymous mode, the reverse proxy unconditionally attaches a 'RoleReader' JWT to requests, granting unauthenticated attackers access to 31 MCP tools. These tools include file primitives (list, read, write, delete) that allow an attacker to exfiltrate 'conf/conf.json' (containing plaintext API tokens and auth codes) or plant malicious JavaScript plugins. On desktop versions, these plugins execute with 'nodeIntegration:true' and no 'contextIsolation', leading to remote code execution (RCE) and full administrator takeover. The issue is fixed in version 3.7.2.
Affected products
- siyuan-note SiYuan < 3.7.2
Timeline
- 2026-07-04: other: Vulnerable version 3.7.1 released
- 2026-07-13: advisory: GitHub Security Advisory published
- 2026-07-25: disclosed: NVD publication date