CVE-2026-100642: SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.8.4
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Users running affected SiYuan versions whose browser can reach the local SiYuan loopback service are exposed. Exploitation requires a victim to visit an attacker-controlled malicious web page.
Does exploitation require SiYuan credentials or prior access?
No. The affected CheckAuth lock-screen pass-through branch grants administrator access to loopback requests without Origin validation, allowing zero-credential cross-origin requests from the victim's browser.
What can an attacker do through a successful exploit?
An attacker can cause the kernel process to terminate, read workspace configuration and proxy settings, and invoke administrative actions through the victim's local SiYuan instance.
What versions should be remediated?
The issue affects SiYuan versions from v2.1.0 before v3.8.4. Update to v3.8.4 or later.