CVE-2026-54069 Scanner

SiYuan Note is a software application used for note-taking and organization. It is commonly utilized by individuals and teams for managing and structuring information in a coherent and accessible way. The platform offers a variety of features to enhance productivity, such as markdown support and data interaction. Its primary users range from students to professionals who require a robust tool for cataloging thoughts, schedules, and data collaboratively. The application is favored for its ease of use and ability to handle complex note-taking tasks. SiYuan Note supports numerous extensions, further broadening its functionalities.

The authentication bypass vulnerability in SiYuan Note is a critical security issue that allows attackers to gain unauthorized access. This vulnerability is caused by the CheckAuth middleware's unconditional trust in all chrome-extension:// origins. It enables attackers to obtain RoleAdministrator access by spoofing the Origin header without requiring token validation. As a result, the exploit allows for bypassing authentication protocols, granting full administrative privileges to unauthorized users. This flaw was present in versions 3.6.5 and prior and has been addressed and fixed in version 3.7.0.

The technical vulnerability details revolve around improperly secured middleware within the SiYuan Note application. Attackers can manipulate the 'Origin' header to match trusted chrome-extension origins. A successful exploitation occurs when a POST request to an admin API endpoint is made under this spoofed context. Upon execution, the attack vector modifies server logic and validates the action, effectively bypassing normal authentication barriers. No validation checks between expected and incoming headers create a loophole where unauthorized privilege escalation is achieved. This flaw gives malicious actors unprecedented access to high-level configurations and data.

The potential impacts of this vulnerability, when exploited, are severe and broad in scope. Unauthorized attackers can gain administrator-level access and carry out actions reserved for legitimate users, potentially leading to full data exfiltration. Malicious users might also inject stored XSS payloads, compromising data integrity and augmenting further attacks. Sensitive configurations can be tampered with, altering application functionality and potentially disrupting service availability. The breach can facilitate unauthorized monitoring or alteration of critical information, leading to financial and reputational damage for organizations.

REFERENCES

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3
• https://nvd.nist.gov/vuln/detail/CVE-2026-54069