CVE-2026-66012 in SiYuan
Summary
by MITRE • 07/25/2026
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files in the workspace, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/25/2026
The SiYuan vulnerability represents a critical authorization flaw that fundamentally undermines the security model of the application. This weakness exists within the POST /mcp kernel endpoint where access control is insufficiently enforced through a generic authentication check that fails to distinguish between different user roles or privilege levels. The vulnerability is particularly dangerous because it grants access to 31 MCP tools without proper administrative role verification, creating a pathway for attackers to exploit the system's file operations capabilities across the entire workspace.
The technical exploitation of this vulnerability begins with the specific configuration where the Publish server operates in anonymous mode through the combination of Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false settings. When these conditions are met, the Publish reverse proxy automatically attaches an anonymous RoleReader JWT token to all proxied requests, effectively bypassing normal authentication mechanisms. This design flaw creates a direct attack vector that allows unauthenticated remote adversaries to reach the vulnerable /mcp endpoint without any prior authorization.
The impact of this vulnerability extends far beyond simple data access, as it enables attackers to extract critical system information from the conf/conf.json file where sensitive credentials including accessAuthCode, api.token, and cookieKey are stored in plaintext format. This credential exposure provides attackers with the means to escalate their privileges within the system. Additionally, the ability to write arbitrary files throughout the workspace allows for persistent malware deployment, particularly through the data/plugins/ directory where malicious plugins can be installed that execute with nodeIntegration:true and no contextIsolation settings.
The ultimate consequence of this vulnerability is complete administrative takeover of the system, as the deployed plugin will execute with elevated privileges during the next desktop application launch. This represents a classic privilege escalation scenario that leverages the application's own trust model against itself. The combination of insufficient authorization controls, improper configuration management, and the lack of proper privilege separation creates a cascading security failure that allows attackers to move from initial access through credential extraction to persistent compromise and full system control.
This vulnerability aligns with CWE-863 (Incorrect Authorization) and represents a significant deviation from secure coding practices that emphasize principle of least privilege and role-based access control. The ATT&CK framework categorizes this as privilege escalation through application misconfiguration, specifically targeting the T1078 (Valid Accounts) and T1543 (Create or Modify System Process) techniques. Organizations implementing SiYuan should immediately review their configuration settings to disable anonymous publishing mode when not required, enforce proper authentication mechanisms, and implement network segmentation to limit access to sensitive endpoints. Regular security audits should verify that all administrative interfaces require proper authorization checks and that credential storage follows industry best practices for encryption and access control.
The root cause of this vulnerability demonstrates a fundamental failure in the application's security architecture where role-based access controls are not properly enforced at the kernel endpoint level. This flaw represents a critical design oversight that allows attackers to bypass multiple security layers through a single misconfigured component, highlighting the importance of comprehensive security testing and proper authorization implementation throughout all application components rather than relying on superficial authentication checks that do not adequately protect system resources.