CVE-2026-100646 in SiYuan
Summary
by MITRE • 09/26/2026
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/26/2026
SiYuan is a self-hosted personal knowledge management system that relies on session-based authentication to secure access to sensitive data and administrative functions. In versions up to and including 3.8.3, the application contains critical flaws within its kernel's authentication guards, specifically in the CheckAuth function located in kernel/model/session.go and the IsSessionOriginAllowed function in kernel/util/net.go. These components are responsible for validating incoming HTTP requests against security policies designed to prevent cross-site request forgery and unauthorized access. The core technical flaw lies in an incorrect assumption regarding browser behavior: the authentication logic assumes that any cross-site request initiated by a web browser will include an Origin header. This assumption is fundamentally flawed because modern browsers omit the Origin header on certain types of requests, most notably cross-site top-level GET navigations and no-cors GET subresource loads. Consequently, when such requests are made without an Origin header, the authentication guards fail open, effectively bypassing security checks that rely on the presence or value of this header to determine request legitimacy.
The operational impact of this vulnerability is severe due to its interaction with cookie attributes and network proxy behaviors. The session cookies used by SiYuan are configured with a SameSite=Lax attribute, which typically restricts cross-site requests from sending credentials unless they originate from a top-level navigation or specific user actions. However, because the authentication logic incorrectly grants access when the Origin header is missing, an attacker can exploit this gap using simple HTML pages hosted on any domain under their control. By crafting a single cross-site GET request that triggers these conditions, an unauthenticated remote attacker can successfully authenticate as RoleAdministrator. This bypass applies to both default installations with no additional access-authorization code and password-protected instances where a valid session is already active in the victim's browser. The vulnerability allows the attacker to assume full administrative privileges without needing prior credentials or complex exploitation techniques beyond standard web interaction.
Furthermore, this authentication flaw is compounded by content-type sniffing vulnerabilities present on the /api/network/proxy endpoint of the application. This endpoint fails to strictly enforce MIME type validation, allowing an attacker-controlled HTML payload to be served and interpreted as executable script under SiYuan's own origin context. When combined with the session hijacking capability described above, this enables a potent cross-site scripting attack vector. An unauthenticated remote attacker can execute arbitrary JavaScript within the security context of http://127.0.0.1:6806, which is the default local address for SiYuan instances. This allows the attacker to invoke administrator-level APIs directly from the victim's browser session and exfiltrate sensitive information, including persistent kernel API tokens that provide long-term access to the system. The combination of these flaws results in a complete compromise of confidentiality and integrity for self-hosted deployments running affected versions.
This vulnerability is classified under CWE-287 as an Improper Authentication issue, specifically reflecting the failure to correctly validate authentication credentials based on flawed assumptions about request metadata. It also aligns with ATT&CK technique T1095, Non-Application Layer Protocol, in contexts where protocol-level behaviors like header omission are exploited, though it primarily manifests as a web application logic flaw similar to CWE-346, Origin Validation Error. The issue highlights the dangers of relying on implicit browser behaviors for security decisions without explicit validation. To mitigate this risk, users must upgrade immediately to version 3.8.4 or later, where these authentication guards have been corrected to handle missing Origin headers appropriately and enforce stricter content-type policies on proxy endpoints. Until an update is applied, administrators should consider restricting network exposure of the SiYuan instance to trusted sources only and monitoring for unusual administrative API calls originating from unexpected IP addresses or user agents.