CVE-2026-72809 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The SiYuan vulnerability represents a critical authentication bypass flaw that undermines the security model of the application's kernel authentication system. This weakness exists within the CheckAuth function where the system grants administrative privileges to any request originating from the loopback address 127.0.0.1, regardless of proper authentication credentials. The vulnerability affects specific endpoints including system exit functions, network information retrieval, workspace data access, and asset and export operations, creating a significant attack surface that could be exploited by malicious actors.
The technical implementation of this flaw stems from improper trust assumptions within the application's networking layer. When requests pass through a fixed-port reverse proxy, they are forwarded to the kernel component with RemoteAddr set to 127.0.0.1 since the proxy does not inject authentication tokens and fails to configure trusted proxy settings properly. This architectural design creates a fundamental security gap where legitimate internal communication patterns become exploitable by external attackers who can manipulate network traffic to appear as if it originates from localhost.
The operational impact of this vulnerability extends beyond typical authentication bypass scenarios due to its specific targeting of administrative endpoints. Attackers who can reach the fixed-port proxy could potentially execute system-level operations including application termination, network configuration access, workspace information disclosure, and asset manipulation through the exposed API endpoints. The vulnerability's severity is amplified by the fact that it operates independently of configured access codes, rendering traditional authentication barriers ineffective against this specific attack vector.
Security implications align with CWE-287 which addresses improper authentication issues, and the attack pattern corresponds to MITRE ATT&CK technique T1078 for valid accounts and T1566 for phishing attacks. The vulnerability demonstrates poor network security configuration practices where trust relationships are incorrectly established based on IP address alone without proper token validation or proxy header verification. Organizations using SiYuan versions below v3.7.4 face potential complete system compromise through unauthorized administrative access, making this a critical issue requiring immediate attention.
The mitigation strategy involves upgrading to version v3.7.4 which addresses the authentication bypass through proper proxy configuration and removal of the loopback trust mechanism for sensitive endpoints. Additionally, administrators should implement proper reverse proxy configurations with trusted proxy headers, ensure access code enforcement remains active, and consider network segmentation to limit exposure of the fixed-port service to untrusted networks. The vulnerability highlights the importance of maintaining secure coding practices around authentication mechanisms and the dangers of assuming trust based solely on network location without proper token validation.