CVE-2026-100646
Deferred Deferred - Pending Action

Authentication Bypass in SiYuan Knowledge Base

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100646
EUVD
EUVD-2026-87740

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.8.3 (inc)
siyuan siyuan 3.8.4
siyuan siyuan From 3.8.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SiYuan versions up to 3.8.3. The system's authentication guards incorrectly assume browser-initiated cross-site requests always include an Origin header. When this header is missing, the system grants administrative privileges. Attackers can exploit this by sending a cross-site GET request from a controlled webpage, combined with content-type sniffing on the /api/network/proxy endpoint, to execute arbitrary scripts and steal the kernel API token.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version prior to 3.8.4. Use commands like 'curl -s http://127.0.0.1:6806/version' or inspect the application's version file. If the version is <=3.8.3, the system is vulnerable.

Impact Analysis

An unauthenticated remote attacker could gain administrator access, execute arbitrary scripts in the SiYuan origin, invoke privileged APIs, and steal the persistent kernel API token. This could lead to full workspace compromise, unauthorized data access, configuration changes, and persistent unauthorized access to the system.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. It may result in unauthorized data exposure, configuration tampering, and persistent unauthorized access, all of which are critical compliance violations for data protection regulations.

Mitigation Strategies

Upgrade SiYuan to version 3.8.4 or later immediately. If upgrading is not possible, restrict network access to the SiYuan instance and disable the /api/network/proxy endpoint to prevent content-type sniffing attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100646. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart