CVE-2026-72809 SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

What is CVE-2026-72809?

CVE-2026-72809 is a high-severity authentication bypass vulnerability in siyuan-note siyuan, published on 12 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.

Weakness: CWE-290

Which versions are affected by CVE-2026-72809?

3 open source packages ship an affected version, including github.com/siyuan-note/siyuan/kernel.

How do I fix CVE-2026-72809?

Upgrade github.com/siyuan-note/siyuan/kernel to 0.0.0-20260723031701-9c16e9851f0b or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-72809 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72809 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3mp7-4rh5-jrv9, GO-2026-6386.