CVE-2026-72809: SiYuan kernel localhost-trust admin bypass on auth-gated endpoints

CVE-2026-72809 · Severity: high · CVSS 8 · Published 2026-08-12

SiYuan is a note-taking application that can be configured with an access authentication code to protect administrative APIs. However, the kernel's authentication logic grants administrator rights to any request originating from the loopback address (127.0.0.1), bypassing the access code for sensitive endpoints like workspace information, network configuration, and system shutdown. If the application's fixed-port reverse proxy is exposed on a network interface, remote attackers could exploit this to gain unauthorized admin access and shut down the service, access workspace data, or read protected assets without any credentials.

Technologies: github.com/siyuan-note/siyuan/kernel (Go). Vendors: Go.

Quick answers

Is CVE-2026-72809 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72809 being exploited in the wild.
How severe is CVE-2026-72809?
High severity, with a CVSS score of 8, published 12 August 2026.
Which products and versions are affected?
github.com/siyuan-note/siyuan/kernel (Go) < 0.0.0-20260723031701-9c16e9851f0b, SEMVER:introduced=0,fixed=0.0.0-20260723031701-9c16e9851f0b.
Is there a fix for CVE-2026-72809?
Yes. github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260723031701-9c16e9851f0b or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72809 attacked?
It is attacked with local access or from the adjacent network, in a web application.
Am I affected by CVE-2026-72809?
Check whether you run github.com/siyuan-note/siyuan/kernel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/siyuan-note/siyuan/kernel (Go): upgrade to 0.0.0-20260723031701-9c16e9851f0b or later
    go get github.com/siyuan-note/siyuan/kernel@v0.0.0-20260723031701-9c16e9851f0b

Technical details

This vulnerability involves an authentication bypass in the SiYuan kernel's CheckAuth function (session.go:298-321) that grants RoleAdministrator to requests with RemoteAddr == 127.0.0.1 for specific endpoints including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*. The critical flaw is that these localhost-trust bypasses sit outside the accessAuthCode gate, meaning they apply even when an access auth code is configured. Part A of the vulnerability (confirmed via proof-of-concept) shows that a loopback-sourced request obtains admin privileges without authentication. Part B (code inspection only) indicates that the fixed-port reverse proxy (fixedport.go) forwards requests to the kernel over 127.0.0.1, injects no authentication token, and lacks SetTrustedProxies configuration, so it would reach the kernel with RemoteAddr = 127.0.0.1. If this proxy is bound to a non-loopback network interface, a remote unauthenticated attacker could reach these admin endpoints. The fix requires either injecting an explicit role/token in the proxy, configuring SetTrustedProxies to derive real client addresses, or requiring auth codes for these endpoints regardless of source address.

Affected products

  • siyuan-note siyuan < 0.0.0-20260723031701-9c16e9851f0b

Identifiers

  • CVE-2026-72809
  • GHSA-3mp7-4rh5-jrv9
  • GO-2026-6386

Timeline

  • 2026-07-23: disclosed: Vulnerability initially published to GitHub Advisory Database
  • 2026-09-03: advisory: Published to GitHub Advisory Database
  • 2026-07-23: patched: Patched version 0.0.0-20260723031701-9c16e9851f0b available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.