SiYuan CVE-2026-100642

Requires the victim to be running the SiYuan kernel process (default loopback/localhost binding) and to visit an attacker-controlled web page in a browser on the same host (UI:P). The vulnerable path is the CheckAuth lock-screen pass-through branch, which grants administrator privileges to loopback requests without validating the Origin header, so no credentials or authenticated session are needed once a request reaches the local kernel. Limiting factors: exploitation is browser-mediated and needs user interaction (visiting the malicious page); impact is bounded to kernel termination (DoS), disclosure of workspace configuration and proxy settings, and admin action triggering rather than full arbitrary code execution; a kernel not exposed to the browser context (e.g., not running, or isolated) is not reachable. Fixed in v3.8.4.

The signals point to a genuine but conditional risk rather than a mass-exploitation emergency. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity CSRF requiring victim interaction (visiting a malicious page), with the dominant impact being availability (VA:H - forced kernel termination) plus minor confidentiality/integrity (VC:L/VI:L - reading workspace config/proxy settings and triggering admin actions). No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is best characterized as no public exploit identified at time of analysis. The root cause (CWE-346 Origin Validation Error in the CheckAuth lock-screen pass-through branch that trusts loopback requests without checking Origin headers) is a well-understood, easily weaponizable class, but exploitation still depends on the victim running the SiYuan kernel locally and being lured to an attacker page. PR:N is defensible because the flaw specifically BYPASSES authentication for loopback requests - the whole point is zero-credential admin access - so no vendor account is needed, though the browser-mediated UI:P requirement caps real-world spread. Net: a real, patch-now issue for SiYuan users, but the single-user desktop footprint and required user interaction make it targeted-opportunistic rather than wormable. No conflicting data noted; the CVSS vector and description are internally consistent.

A SiYuan user running the desktop kernel (bound to loopback) visits an attacker-controlled web page in the same browser. Embedded JavaScript issues zero-credential cross-origin requests to the local kernel; because the lock-screen pass-through branch grants administrator access to loopback requests without validating the Origin header, the page can read the workspace configuration and proxy settings and force the kernel process to terminate. No public exploit code is identified at time of analysis, but the technique is a standard CSRF against an unprotected localhost service.