CVE-2026-72809
SiYuan before v3.7.4 Authentication Bypass via Localhost Trust
Description
SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.
INFO
Published Date :
Aug. 12, 2026, 8:17 p.m.
Last Modified :
Oct. 23, 2026, 10:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update SiYuan to version 3.7.4 or later.
- Restrict network access to the affected application.
- Review and configure trusted proxies for the kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72809.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72809 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72809
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72809 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72809 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Changed Translation Title: siyuan de siyuan-note, Description: Las versiones de SiYuan <= v3.7.2 (parcheadas en v3.7.4) contienen una vulnerabilidad de omisión de autenticación en la función CheckAuth del kernel, que otorga el rol de administrador (RoleAdministrator) a cualquier solicitud cuya RemoteAddr sea loopback (127.0.0.1) para un conjunto específico de endpoints (incluyendo /api/system/exit, getNetwork, getWorkspaceInfo, /assets/* y /export/*). Estas omisiones de localhost se encuentran fuera de la puerta de código de autenticación de acceso, por lo que se aplican incluso cuyo se configura un código de autenticación de acceso. Debido a que el proxy inverso de puerto fijo reenvía solicitudes al kernel a través de loopback sin inyectar un token de autenticación y no configura proxies de confianza, una solicitud reenviada a través de este proxy llega al kernel con RemoteAddr = 127.0.0.1. Si el proxy de puerto fijo está vinculado a una interfaz de red, esto podría permitir a un atacante remoto no autenticado obtener acceso de administrador en los endpoints afectados; sin embargo, según el aviso, este comportamiento de reenvío remoto se estableció solo mediante inspección de código y no se reprodujo de extremo a extremo. Title: siyuan de siyuan-note, Description: Las versiones de SiYuan menor o igual a v3.7.2 (parcheadas en v3.7.4) contienen una vulnerabilidad de omisión de autenticación en la función CheckAuth del kernel, que otorga el rol de administrador (RoleAdministrator) a cualquier solicitud cuya RemoteAddr sea loopback (127.0.0.1) para un conjunto específico de endpoints (incluyendo /api/system/exit, getNetwork, getWorkspaceInfo, /assets/* y /export/*). Estas omisiones de localhost se encuentran fuera de la puerta de código de autenticación de acceso, por lo que se aplican incluso cuyo se configura un código de autenticación de acceso. Debido a que el proxy inverso de puerto fijo reenvía solicitudes al kernel a través de loopback sin inyectar un token de autenticación y no configura proxies de confianza, una solicitud reenviada a través de este proxy llega al kernel con RemoteAddr = 127.0.0.1. Si el proxy de puerto fijo está vinculado a una interfaz de red, esto podría permitir a un atacante remoto no autenticado obtener acceso de administrador en los endpoints afectados; sin embargo, según el aviso, este comportamiento de reenvío remoto se estableció solo mediante inspección de código y no se reprodujo de extremo a extremo. -
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: siyuan de siyuan-note, Description: Las versiones de SiYuan <= v3.7.2 (parcheadas en v3.7.4) contienen una vulnerabilidad de omisión de autenticación en la función CheckAuth del kernel, que otorga el rol de administrador (RoleAdministrator) a cualquier solicitud cuya RemoteAddr sea loopback (127.0.0.1) para un conjunto específico de endpoints (incluyendo /api/system/exit, getNetwork, getWorkspaceInfo, /assets/* y /export/*). Estas omisiones de localhost se encuentran fuera de la puerta de código de autenticación de acceso, por lo que se aplican incluso cuyo se configura un código de autenticación de acceso. Debido a que el proxy inverso de puerto fijo reenvía solicitudes al kernel a través de loopback sin inyectar un token de autenticación y no configura proxies de confianza, una solicitud reenviada a través de este proxy llega al kernel con RemoteAddr = 127.0.0.1. Si el proxy de puerto fijo está vinculado a una interfaz de red, esto podría permitir a un atacante remoto no autenticado obtener acceso de administrador en los endpoints afectados; sin embargo, según el aviso, este comportamiento de reenvío remoto se estableció solo mediante inspección de código y no se reprodujo de extremo a extremo. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 14, 2026
Action Type Old Value New Value Added Reference https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3mp7-4rh5-jrv9 Added SSVC {'id': 'CVE-2026-72809', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-14T22:06:55.491557Z'} -
New CVE Received by [email protected]
Aug. 12, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'siyuan-note', 'product': 'siyuan', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.7.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '3.7.4', 'versionType': 'semver'}], 'packageURL': 'pkg:golang/github.com/siyuan-note/siyuan/kernel', 'defaultStatus': 'unaffected'}] Added Description SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end. Added CVSS V4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H Added CWE CWE-290 Added Reference https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3mp7-4rh5-jrv9 Added Reference https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-localhost-trust