Description

SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-auth mode can read templates, snippets, and export artifacts by directly accessing static routes that lack the same restrictions as their REST API counterparts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-08-12T20:17:51.267Z",
  "pubdate": "2026-08-12T20:17:51.267Z",
  "executiveSummary": "SiYuan before v3.7.4 suffers from an access control bypass vulnerability affecting server mux static-file routing mechanisms. This flaw allows unauthorized or low-privileged actors to circumvent publish-access controls normally enforced by the REST API.\nThe vulnerability impacts SiYuan instances prior to version v3.7.4. The primary business risk involves the unauthorized exposure of sensitive internal data, including templates, code snippets, and export artifacts, which should otherwise be restricted based on access configurations.\nAttackers possessing publish reader tokens or operating within an anonymous access context under disabled-auth mode can successfully leverage this vulnerability. Exploitation requires no advanced privileges beyond the baseline access token or anonymous state, but relies on direct interaction with static routing endpoints that fail to mirror the rigorous authorization checks implemented on parallel REST API routes.",
  "technicalDetails": "The root cause of the vulnerability lies in a discrepancy within the authorization enforcement framework across the server multiplexer (mux). While the core REST API endpoints correctly implement publish-access controls to validate user privileges and tokens before serving resources, the parallel static-file routes mapped in the server mux lack equivalent access validation logic.\nThe vulnerable components are the static-file serving mechanisms handling resource retrieval within the SiYuan server architecture. Because these static routes process requests independently of the REST API security middleware, they bypass the intended authentication and authorization checks designed to protect sensitive content.\nThe affected product is SiYuan, specifically all versions prior to v3.7.4. The vulnerability is exploitable over the network, exposing endpoints directly to remote actors who have network reachability to the application server instance.\nThe attack flow proceeds as follows: First, an attacker establishes network connectivity to the targeted SiYuan instance. Depending on the server configuration, the attacker either utilizes a valid publish reader token or exploits an environment operating in disabled-auth mode with anonymous access enabled. Instead of querying the protected REST API endpoints—which would normally enforce granular access controls—the attacker directly crafts HTTP requests targeted at the static-file routes corresponding to the desired assets. Because the server mux fails to evaluate publish-access restrictions on these static paths, the application processes the request and returns the requested resources.\nThe payload behavior involves direct URI manipulation to point toward sensitive file locations. Post-exploitation impact encompasses the unauthorized retrieval and exfiltration of confidential information stored within the application, such as custom templates, sensitive text snippets, and generated export artifacts, potentially violating data confidentiality and privacy boundaries."
}