CVE-2026-74867 in SiYuan
Summary
by MITRE • 08/17/2026
SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in SiYuan versions prior to 3.7.4 represents a critical failure in the implementation of cross-site request forgery defenses within its authentication mechanism. The core technical flaw resides in the CheckAuth function, specifically within the session-cookie authentication branch. This component is responsible for validating user sessions and authorizing subsequent actions based on the presence of valid credentials. However, it fails to implement essential server-side validation checks such as verifying the Origin or Referer HTTP headers. These headers are standard mechanisms used by web applications to ensure that incoming requests originate from trusted sources rather than malicious third-party domains. By omitting these validations, the application relies entirely on client-side browser behaviors for protection, which is an insufficient security posture in modern threat landscapes where attackers can manipulate request contexts with relative ease.
Furthermore, the vulnerability is exacerbated by the configuration of session cookies lacking an explicit SameSite attribute. The SameSite cookie attribute is a critical defense-in-depth measure designed to prevent browsers from sending cookies along with cross-site requests. When this attribute is not explicitly set to Strict or Lax, modern browsers may apply their default policies, which have historically varied and often allow cookies to be sent in certain cross-origin contexts. This oversight means that if an attacker can trick a user into visiting a malicious webpage while authenticated in SiYuan, the browser will automatically attach the valid session cookie to any requests initiated from that page. The application then accepts these requests as legitimate because it cannot distinguish them from genuine user-initiated actions due to the absence of robust server-side origin verification and weak cookie attributes.
The operational impact of this vulnerability is significant for users who rely on SiYuan for storing sensitive notes, documents, or personal data. An attacker can craft a malicious web page containing automated requests that target specific endpoints within the SiYuan application. When an authenticated user visits this page, their browser will submit these forged requests with valid session cookies attached. This allows the attacker to perform unauthorized actions on behalf of the victim without requiring any additional interaction such as clicking links or entering credentials. Depending on the privileges associated with the compromised account, this could lead to data exfiltration, modification or deletion of critical documents, creation of new administrative accounts, or other malicious activities that compromise the integrity and confidentiality of the user's workspace.
From a classification perspective, this vulnerability aligns closely with CWE-352, which describes Cross-Site Request Forgery (CSRF). The lack of Origin/Referer validation corresponds to common implementation errors where developers assume browser defaults are sufficient for security. Additionally, the missing SameSite attribute relates to weaknesses in cookie management practices often cited in OWASP guidelines as a best practice for mitigating CSRF attacks. In terms of adversary tactics, this vulnerability facilitates actions consistent with ATT&CK techniques involving social engineering and web-based client-side exploitation, allowing attackers to leverage trusted sessions to execute commands within the application environment.
To mitigate this risk, immediate action is required by upgrading SiYuan to version 3.7.4 or later where these issues have been addressed. For environments that cannot immediately upgrade, administrators should consider implementing reverse proxy configurations that enforce strict Origin and Referer header validation before requests reach the application backend. Additionally, configuring session cookies with explicit SameSite attributes set to Strict is recommended if it does not interfere with legitimate cross-site workflows such as single sign-on integrations. Regular security audits focusing on authentication flows and cookie policies are essential to ensure that defenses against CSRF remain robust against evolving attack vectors.