Executive brief
SiYuan is a note-taking application that can be configured with an access authentication code to protect administrative APIs. However, the kernel's authentication logic grants administrator rights to any request originating from the loopback address (127.0.0.1), bypassing the access code for sensitive endpoints like workspace information, network configuration, and system shutdown. If the application's fixed-port reverse proxy is exposed on a network interface, remote attackers could exploit this to gain unauthorized admin access and shut down the service, access workspace data, or read protected assets without any credentials.
Technical details
This vulnerability involves an authentication bypass in the SiYuan kernel's CheckAuth function (session.go:298-321) that grants RoleAdministrator to requests with RemoteAddr == 127.0.0.1 for specific endpoints including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*. The critical flaw is that these localhost-trust bypasses sit outside the accessAuthCode gate, meaning they apply even when an access auth code is configured. Part A of the vulnerability (confirmed via proof-of-concept) shows that a loopback-sourced request obtains admin privileges without authentication. Part B (code inspection only) indicates that the fixed-port reverse proxy (fixedport.go) forwards requests to the kernel over 127.0.0.1, injects no authentication token, and lacks SetTrustedProxies configuration, so it would reach the kernel with RemoteAddr = 127.0.0.1. If this proxy is bound to a non-loopback network interface, a remote unauthenticated attacker could reach these admin endpoints. The fix requires either injecting an explicit role/token in the proxy, configuring SetTrustedProxies to derive real client addresses, or requiring auth codes for these endpoints regardless of source address.
Affected products
- siyuan-note siyuan < 0.0.0-20260723031701-9c16e9851f0b
Timeline
- 2026-07-23: disclosed: Vulnerability initially published to GitHub Advisory Database
- 2026-09-03: advisory: Published to GitHub Advisory Database
- 2026-07-23: patched: Patched version 0.0.0-20260723031701-9c16e9851f0b available