SiYuan EUVD-2026-109427

Requires that an operator has enabled network serving and then set networkServeTLS=true via POST /api/system/setNetworkServeTLS expecting encrypted transport - the kernel persists but never enforces this, so the port keeps serving full-API plain HTTP. The attacker must additionally occupy a network-adjacent position (same LAN/segment) to sniff the cleartext login flow and session cookie. Exploitation is aided by two compounding defects on the same transport path: the session cookie from session.go line 140 is issued without the Secure attribute (only HttpOnly and SameSite=Lax), and HTTPS responses carry no Strict-Transport-Security header, allowing cookie leakage over any cleartext request and browser downgrade. Limiting factors: no remote/internet vector (adjacency only), high attack complexity, and dependence on the operator having turned on the toggle; attackers with no sniffing position cannot exploit it.

The supplied CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N, base 7.6) describes a network-adjacent, no-privilege, no-interaction flaw whose exploitation carries a defined attack requirement (AT:P) and high complexity (AC:H) - these map directly to the two stated preconditions: the attacker must hold a network-adjacent sniffing position and the operator must have enabled the networkServeTLS toggle. The GHSA advisory reports the cleartext behavior was verified live on v3.8.6 and publishes concrete PoC steps, so the mechanism is confirmed rather than inferred; however, no EPSS score and no KEV status were provided in the input, so widespread-exploitation probability cannot be quantified from the data. There is no public exploit identified as weaponized code - a public PoC reference exists in the advisory but is not verified as working exploit code. The vuln.today decision label is this_week and the reporting vendor itself suggested a Medium rating (not High) precisely because exploitation requires adjacency plus an operator who enabled the setting; this is therefore a credible but conditioned priority rather than a drop-everything internet-wide threat, and the adjacency plus operator-toggle gate meaningfully limits real-world blast radius despite the High-band score.

An operator enables networkServeTLS believing kernel traffic is now encrypted, but the kernel port continues answering full-API plain HTTP alongside HTTPS on the same port. An attacker on the same LAN or adjacent network segment passively sniffs the cleartext login flow, captures the submitted access auth code and the 30-day session cookie (which lacks the Secure attribute while responses omit HSTS), and replays the cookie to take over the victim's kernel API session. Published PoC steps in the GHSA advisory demonstrate the cleartext response and the missing Secure/HSTS controls on v3.8.6.