SiYuan CVE-2026-74867

Three conditions must align: (1) The victim must have an active authenticated SiYuan session in the browser at the time of attack. (2) The SiYuan instance must be reachable from the browser making the cross-origin request - localhost-only deployments are not exploitable from external pages in standard browser security models. (3) The browser's SameSite default policy must permit the cross-origin cookie submission for the specific HTTP method used - modern browsers defaulting to SameSite=Lax block cross-origin POST but may allow certain GET-triggered requests, constraining which API actions can be forged. Passive user interaction is required: the victim must visit attacker-controlled content (UI:P). Exploitation is not possible against isolated localhost-bound SiYuan instances when the attacker cannot reach the service, nor against users who are not currently authenticated.

The CVSS 4.0 score of 2.3 accurately reflects low real-world priority. AC:H indicates high attack complexity: the browser's SameSite default behavior, the user's session state, and the network reachability of the SiYuan instance must all align simultaneously. AT:P (attack requirements: present) further confirms specific preconditions are necessary. UI:P requires passive victim interaction - the user must visit attacker-controlled content while authenticated. Impact is bounded: VC:L/VI:L captures limited note data exposure and integrity modification; VA:N and all subsequent-system metrics are N, consistent with SiYuan being a personal-scope application. No EPSS data was provided in the input; no CISA KEV listing is noted; no public POC has been identified. The primary real-world risk concentrates on networked or shared SiYuan deployments (e.g., team instances or cloud-hosted) rather than the common localhost-only personal deployment pattern. CVSS signals are internally consistent with the description - no conflicting data identified.

An attacker hosts a malicious web page containing a hidden form or JavaScript fetch targeting a SiYuan API endpoint (e.g., to delete notes or modify workspace settings). When an authenticated SiYuan user on a networked or shared deployment visits that page in the same browser, the browser automatically attaches the valid SiYuan session cookie to the cross-origin request. Because CheckAuth() performs no Origin or Referer check, the forged request is processed as legitimate, executing the unauthorized action. No public exploit code has been identified at time of analysis.