CVE-2026-100646 Overview
SiYuan is a self-hosted personal knowledge management system vulnerable to an authentication bypass in versions up to and including 3.8.3. The kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent. Browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads, and the session cookie uses SameSite=Lax. A single cross-site GET from any attacker-controlled page is granted RoleAdministrator. The flaw is fixed in SiYuan 3.8.4.
Critical Impact
An unauthenticated remote attacker can execute arbitrary script in the SiYuan origin, invoke administrator APIs, and exfiltrate the persistent kernel API token.
Affected Products
- SiYuan kernel versions up to and including 3.8.3
- Default installations with no access-authorization code configured
- Password-protected SiYuan instances with an active browser session
Discovery Timeline
- 2026-09-26 - CVE-2026-100646 published to the National Vulnerability Database (NVD)
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100646
Vulnerability Analysis
The vulnerability is an Origin Validation Error [CWE-346] in the SiYuan kernel's request authentication path. CheckAuth and IsSessionOriginAllowed validate the HTTP Origin header only when it is present. When the header is missing, both functions treat the request as same-origin and grant the session the RoleAdministrator privilege. The design assumes any browser-initiated cross-site request carries an Origin header, which is incorrect for top-level navigations and no-cors GET subresource loads.
Because the session cookie is set with SameSite=Lax, the browser attaches it to cross-site top-level GET navigations. An attacker-controlled web page can trigger such a navigation to http://127.0.0.1:6806 and inherit administrator-level access. The /api/network/proxy endpoint compounds the issue by permitting content-type sniffing, which lets attacker-controlled HTML be served under SiYuan's own origin.
Root Cause
The authentication guards fail open on a missing Origin header. The code treats absence of the header as proof the request did not originate from another site. Browsers, however, strip Origin from several categories of cross-site GETs, so the check does not reliably distinguish same-origin from cross-origin traffic.
Attack Vector
An attacker hosts a page that forces the victim's browser to issue a cross-site GET to the local SiYuan instance at http://127.0.0.1:6806. The browser omits the Origin header on this navigation but attaches the SameSite=Lax session cookie. The kernel grants administrator access, and the attacker chains the /api/network/proxy content-sniffing behavior to execute script in the SiYuan origin, call administrator APIs, and exfiltrate the persistent kernel API token.
// No verified proof-of-concept code is published for this CVE.
// Refer to GHSA-2w6q-wgc8-q743 and the VulnCheck advisory for
// technical details on the Origin-header bypass and the
// /api/network/proxy content-sniffing primitive.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-100646
Indicators of Compromise
- Inbound HTTP requests to http://127.0.0.1:6806 administrator API endpoints that lack an Origin header and originate from a browser user agent.
- Requests to /api/network/proxy returning responses whose declared and sniffed content types diverge, especially HTML served under the SiYuan origin.
- Unexpected reads or exports of the persistent kernel API token from a SiYuan instance.
Detection Strategies
- Inspect kernel HTTP access logs for authenticated administrator calls paired with missing or anomalous Origin and Referer headers.
- Correlate browser process telemetry with outbound requests to 127.0.0.1:6806 from pages served by non-local domains.
- Alert on invocations of administrator APIs that follow a top-level navigation rather than an in-app XHR or fetch call.
Monitoring Recommendations
- Enable verbose HTTP request logging on the SiYuan kernel and forward logs to a centralized analytics platform for retention and query.
- Monitor endpoint EDR telemetry for browser child processes initiating connections to loopback service ports used by local knowledge-management tools.
- Track egress of API tokens or configuration exports from hosts running SiYuan.
How to Mitigate CVE-2026-100646
Immediate Actions Required
- Upgrade SiYuan to version 3.8.4 or later on all workstations and self-hosted deployments.
- Rotate the persistent kernel API token after upgrading, in case prior exfiltration occurred.
- Restrict network exposure of the SiYuan kernel to loopback only and avoid binding 6806 to routable interfaces.
Patch Information
The vendor fixed the issue in SiYuan 3.8.4. The patch corrects CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go so that requests with a missing Origin header are no longer treated as same-origin. See the GitHub Security Advisory GHSA-2w6q-wgc8-q743 and the VulnCheck Advisory for full details.
Workarounds
- Close the browser or clear SiYuan session cookies before visiting untrusted websites if upgrading is not immediately possible.
- Use a dedicated browser profile for SiYuan to prevent SameSite=Lax cookies from being replayed by other browsing activity.
- Block outbound browser connections to 127.0.0.1:6806 from non-SiYuan origins at the host firewall where feasible.
# Example host firewall rule restricting access to the SiYuan kernel port
# Allow only loopback traffic to port 6806
iptables -A INPUT -p tcp --dport 6806 ! -i lo -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
