CVE-2026-72809: SiYuan Auth Bypass Vulnerability

CVE-2026-72809 Overview

CVE-2026-72809 is an authentication bypass vulnerability in SiYuan, an open-source personal knowledge management application. Versions <= v3.7.2 contain a flaw in the kernel's CheckAuth function that grants the RoleAdministrator role to any request whose RemoteAddr is loopback (127.0.0.1). The bypass applies to a specific set of endpoints, including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*. These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. The vulnerability is tracked as [CWE-290: Authentication Bypass by Spoofing].

Critical Impact
A request forwarded through the fixed-port reverse proxy reaches the kernel with RemoteAddr = 127.0.0.1, potentially granting remote unauthenticated attackers administrator access on affected endpoints.

Affected Products

SiYuan versions <= v3.7.2
SiYuan fixed-port reverse proxy component
SiYuan kernel CheckAuth function

Discovery Timeline

2026-08-12 - CVE-2026-72809 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72809

Vulnerability Analysis

The vulnerability resides in SiYuan's kernel authentication logic. The CheckAuth function inspects the RemoteAddr field of incoming HTTP requests and grants full administrator privileges whenever the source address is loopback. This localhost-trust shortcut applies to a defined set of endpoints, including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*.

Because the loopback check occurs before the access auth code gate, configuring an access auth code does not close the bypass. The kernel treats any request with RemoteAddr = 127.0.0.1 as pre-authenticated for the affected routes.

The practical risk emerges from SiYuan's fixed-port reverse proxy. That proxy forwards inbound requests to the kernel over loopback without injecting an authentication token and without configuring trusted proxies. Any request routed through this proxy reaches the kernel with a loopback RemoteAddr, matching the bypass condition.

Root Cause

The root cause is implicit trust in transport-layer source addressing. The CheckAuth function uses RemoteAddr as a proxy for identity, assuming loopback traffic originates from a trusted local process. This assumption breaks when a reverse proxy forwards external traffic to the kernel over the loopback interface. The absence of trusted-proxy configuration and internal authentication tokens between proxy and kernel completes the bypass chain.

Attack Vector

If the fixed-port proxy is bound to a network interface reachable from outside the host, a remote unauthenticated attacker can issue requests to the affected endpoints. Those requests are forwarded to the kernel with loopback RemoteAddr, receive the RoleAdministrator role, and can invoke administrator-only functions such as /api/system/exit or exfiltrate workspace data through /export/* and /assets/*. Per the advisory, the remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.

The vulnerability mechanism is described in detail in the GitHub Security Advisory and the VulnCheck Advisory.

Detection Methods for CVE-2026-72809

Indicators of Compromise

Unexpected requests to /api/system/exit, getNetwork, or getWorkspaceInfo in SiYuan kernel logs.
Access log entries for /assets/* or /export/* originating from non-local IP addresses forwarded via the fixed-port proxy.
Unexplained SiYuan kernel shutdowns or workspace metadata queries without corresponding user activity.

Detection Strategies

Inventory hosts running SiYuan and verify installed versions against the fixed release v3.7.4.
Inspect proxy configurations to determine whether the fixed-port proxy is bound to a non-loopback network interface.
Correlate kernel access logs with upstream proxy logs to identify requests where the original client address differs from the kernel-observed RemoteAddr.

Monitoring Recommendations

Alert on any external network access to SiYuan's fixed-port proxy address.
Monitor SiYuan process lifecycle events, particularly unexpected kernel exits triggered via /api/system/exit.
Log and review use of /export/* endpoints, which can be abused to exfiltrate workspace content.

How to Mitigate CVE-2026-72809

Immediate Actions Required

Upgrade SiYuan to v3.7.4 or later, where the localhost trust logic in CheckAuth has been corrected.
Restrict the SiYuan fixed-port proxy to bind only to loopback interfaces on multi-user or internet-exposed hosts.
Place SiYuan instances behind a firewall or reverse proxy that enforces authentication before forwarding traffic.

Patch Information

The vendor released a fix in SiYuan v3.7.4. Upgrade details are available in the GitHub Security Advisory GHSA-3mp7-4rh5-jrv9. Administrators should verify the running kernel version after upgrade and confirm that the localhost bypass no longer grants administrator role for the affected endpoints.

Workarounds

Bind SiYuan and its fixed-port proxy exclusively to 127.0.0.1 until the upgrade is applied.
Block external network access to the SiYuan proxy port at the host or perimeter firewall.
Avoid deploying vulnerable SiYuan versions on shared or multi-tenant systems where other users can reach the proxy over the local network.

bash

# Example: restrict SiYuan proxy to loopback via host firewall (iptables)
iptables -A INPUT -p tcp --dport 6806 ! -s 127.0.0.1 -j DROP