CVE-2026-100642
Deferred Deferred - Pending Action

SiYuan CSRF Bypass Grants Admin Access via Loopback Requests

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100642
EUVD
EUVD-2026-87736

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan From 2.1.0 (inc) to 3.8.4 (exc)
siyuan si_yuan From 2.1.0 (inc) to 3.8.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-100642 is a cross-site request forgery (CSRF) vulnerability in SiYuan versions from v2.1.0 before v3.8.4. It exists in the CheckAuth lock-screen pass-through branch, which incorrectly grants administrator access to loopback requests without validating Origin headers. Attackers can exploit this to bypass authentication and perform unauthorized actions like terminating the kernel process or reading sensitive workspace and proxy configurations.

Detection Guidance

To detect this vulnerability, check if your SiYuan version is between 2.1.0 and 3.8.4. Use commands like 'curl -s http://127.0.0.1:6806/api/system/version' to verify the version. Inspect network traffic for unauthorized loopback requests to the SiYuan API without proper Origin headers.

Impact Analysis

If exploited, this vulnerability allows attackers to forcefully terminate your SiYuan kernel process, read your workspace configuration and proxy settings, and trigger administrative actions without any credentials. This could lead to data loss, unauthorized access to sensitive information, or disruption of your SiYuan application.

Mitigation Strategies

Immediately update SiYuan to version 3.8.4 or later. If updating is not possible, restrict loopback access to the SiYuan API by configuring firewalls or network policies. Disable the lock-screen pass-through feature if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100642. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart