DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-72809: CVE-2026-72809: Authentication Bypass in SiYuan via Localhost Trust Spoofing

#security #cve #cybersecurity

CVE-2026-72809: Authentication Bypass in SiYuan via Localhost Trust Spoofing

Vulnerability ID: CVE-2026-72809
CVSS Score: 8.0
Published: 2026-09-03

An authentication bypass vulnerability exists in the SiYuan personal knowledge management system (versions <= v3.7.2). The flaw occurs because the kernel's authorization validation handler trusts loopback connection origins blindly, allowing remote network attackers to gain administrative privileges via an exposed local reverse proxy.

TL;DR

SiYuan versions <= 3.7.2 contain an authentication bypass where the backend kernel automatically grants administrative privileges to any request routed through the local fixed-port proxy due to insecure localhost IP validation. Upgrading to version 3.7.4 resolves the issue.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-290
  • Attack Vector: Local / Network (dependent on proxy binding configuration)
  • CVSS v3.1 Score: 8.0
  • CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • SiYuan personal knowledge management system (versions <= v3.7.2)
  • SiYuan: <= v3.7.2 (Fixed in: v3.7.4)

Code Analysis

Commit: 9c16e98

Configure trusted proxies in Gin, introduce dual-verification local request helper, and refactor reverse proxy to insert client forwarding headers.

Mitigation Strategies

  • Upgrade SiYuan Note to version v3.7.4 or newer
  • Restrict the fixed-port reverse proxy binding address to localhost (127.0.0.1)
  • Implement network firewall rules to block external access to port 6806

Remediation Steps:

  1. Identify active installations of SiYuan running versions <= v3.7.2
  2. Download the v3.7.4 or newer release package from the official repository
  3. Apply the update and restart the backend kernel service
  4. Verify the binding interface configuration of port 6806 to confirm it is not exposed on external interfaces
  5. Test endpoint access from an external node to verify that administrative APIs return HTTP 403 or redirect to login

References

Read the full report for CVE-2026-72809 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)