Executive brief
SiYuan is a note-taking and knowledge management application. The application's kernel contains an authentication bypass flaw that grants administrator privileges to any request originating from localhost (127.0.0.1) on certain endpoints, even when an access authentication code is configured. If a reverse proxy forwards remote requests through localhost without proper authentication, unauthenticated attackers could obtain admin-level access to sensitive functionality like workspace information, file export, and server shutdown capabilities.
Technical details
The vulnerability exists in the CheckAuth function (session.go:298-321) which implements a localhost-trust bypass that grants RoleAdministrator to requests with RemoteAddr = 127.0.0.1 on sensitive endpoints including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*. Critically, these bypasses sit outside the accessAuthCode authentication gate, meaning they apply even when an access authentication code is configured. The fixed-port reverse proxy (fixedport.go) forwards requests to the kernel at 127.0.0.1 without injecting authentication tokens and does not configure SetTrustedProxies, allowing it to preserve the loopback address. If this proxy is bound to a network interface and forwards remote requests to the kernel, unauthenticated attackers could exploit the localhost bypass to gain admin access, potentially enabling remote kernel shutdown (DoS), workspace/network disclosure, and privileged asset/export operations. The fix is available in v3.7.4; suggested remediation includes having proxies inject explicit authentication tokens, configuring trusted proxies, or requiring access auth codes regardless of source address.
Affected products
- SiYuan SiYuan <= 3.7.2
Timeline
- 2026-07-23: disclosed
- 2026-07-23: patched: Patched in v3.7.4