siyuan-note SiYuan up to 3.7.1 MCP Kernel model.CheckAuth improper authorization

Summaryinfo

A vulnerability described as critical has been identified in siyuan-note SiYuan up to 3.7.1. Impacted is the function model.CheckAuth of the component MCP Kernel. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2026-66012. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in siyuan-note SiYuan up to 3.7.1 and classified as critical. This vulnerability affects the function model.CheckAuth of the component MCP Kernel. The manipulation with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files in the workspace, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-66012 since 07/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 3.7.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-49043). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• siyuan-note

Name

• SiYuan

Version

• 3.7.0
• 3.7.1

Website

• Product: https://github.com/siyuan-note/siyuan/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion