SiYuan CVE-2026-100646

Exploitation targets SiYuan kernel versions up to and including 3.8.3 listening on its HTTP endpoint (default http://127.0.0.1:6806). The attacker needs the victim to visit an attacker-controlled web page (UI:P) using a browser that omits the Origin header on cross-site top-level GET navigations / no-cors GET subresource loads; combined with the SameSite=Lax session cookie this bypasses the origin check. It works against default installations that have no access-authorization configured, and against password-protected instances only while the victim has a live authenticated session. The chain further relies on content-type sniffing at /api/network/proxy to host attacker HTML under SiYuan's origin. Limiting factors: requires victim interaction (visiting a page), and for password-protected instances requires an active session; no attacker authentication is required.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) describes a network-reachable, low-complexity flaw an unauthenticated attacker can trigger with only victim interaction (visiting a web page). The core defect (CWE-346, Origin Validation Error) is a fail-open authentication guard: because browsers omit the Origin header on cross-site top-level GET navigations and no-cors GET subresource loads, and the session cookie is SameSite=Lax, a single cross-site GET from any attacker-controlled page is granted RoleAdministrator. Critically, it works on BOTH default installs (no access-authorization) AND password-protected instances with a live session, which widens the realistic victim pool. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data - so there is no evidence of active exploitation; per precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS should not downgrade priority much given the low attack complexity, no-auth requirement, and that the mechanism (missing-Origin CSRF chained to content-type sniffing on /api/network/proxy to achieve script execution in SiYuan's own origin and exfiltrate the persistent kernel API token) is fully described and reproducible. Note the input 'RCE' tag is somewhat generous: the description establishes arbitrary script execution within the SiYuan origin, admin-API invocation, and API-token theft, but does not itself demonstrate host-level code execution (siblings achieve host RCE via Electron nodeIntegration, which this advisory does not invoke).

An attacker hosts a malicious web page and lures a SiYuan user (or anyone running a default local SiYuan instance) to visit it. The page issues a cross-site GET to http://127.0.0.1:6806 with no Origin header; SiYuan's auth guard fails open and treats it as RoleAdministrator, then the /api/network/proxy content-type sniffing is abused to serve attacker HTML under SiYuan's own origin, executing script that calls administrator APIs and exfiltrates the persistent kernel API token. No public exploit code is identified at time of analysis, but the mechanism is fully described in the vendor advisory.