CVE-2026-100642 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in SiYuan versions ranging from v2.1.0 up to but not including v3.8.4 represents a critical security flaw rooted in improper validation of HTTP Origin headers within the application's authentication mechanism. Specifically, this issue resides in the CheckAuth lock-screen pass-through branch of the software architecture. The core technical failure involves the system granting administrator-level access privileges to requests originating from loopback addresses without performing adequate verification of the request origin. In standard web security practices, applications must rigorously validate that incoming requests originate from trusted sources to prevent unauthorized actions. However, in this implementation, the logic assumes that any request coming from a local address is inherently safe and legitimate, thereby bypassing essential cross-origin checks. This design oversight allows an attacker to exploit the trust relationship between the browser and the localhost interface of the SiYuan application.
From an operational perspective, this vulnerability enables severe consequences for users who have administrative privileges within their SiYuan workspaces. An adversary can craft a malicious web page that, when visited by a victim with active administrator sessions or sufficient permissions, forces cross-origin requests to be processed as if they were legitimate local operations. Because the application does not validate the Origin header against an allowlist of trusted domains for these specific administrative endpoints, it accepts commands from arbitrary external sources. This effectively neutralizes the protection offered by Same-Origin Policy mechanisms in this context, allowing attackers to execute actions with full administrator rights without requiring any credentials or user interaction beyond visiting a malicious site if other session management flaws are present or through social engineering tactics that lead users to interact with local services.
The impact of this vulnerability is multifaceted and potentially devastating for data integrity and system stability. Attackers can leverage this flaw to terminate the SiYuan kernel process, which may result in data loss or corruption due to unsaved work being abruptly halted. Furthermore, the ability to read workspace configuration files allows adversaries to extract sensitive proxy settings and other environmental configurations that might reveal network topology details or internal service endpoints. Most critically, the capability to trigger administrative actions means an attacker could modify user permissions, alter application settings, install malicious plugins, or exfiltrate private notes and documents stored within the local database. This transforms a simple web browsing session into a vector for complete system compromise at the application level.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery (CSRF), specifically highlighting the failure to verify that requests originate from trusted sources. Additionally, it relates to CWE-942, as the exploitation involves over-permission through improper validation of origin headers in a local context. In terms of MITRE ATT&CK framework classification, this behavior corresponds to T1078, Valid Accounts, where attackers use legitimate credentials or privileges obtained through other means to maintain access and perform administrative tasks. It also touches upon T1530, Data from Local System, due to the ability to read local configuration files and workspace data without proper authorization checks.
To mitigate this vulnerability, users must upgrade SiYuan to version 3.8.4 or later, where these issues have been addressed by implementing stricter Origin header validation for administrative endpoints. For organizations still running older versions in controlled environments, it is advisable to restrict access to the local interface through network segmentation or firewall rules that prevent external web pages from making requests to localhost ports used by SiYuan. Additionally, enabling strict Content Security Policy headers can help mitigate some aspects of cross-origin exploitation, although upgrading remains the only definitive solution given the depth of the flaw in the authentication logic. Regular security audits and patch management processes are essential to ensure such vulnerabilities do not persist in production environments where sensitive data is processed locally.