Description

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-12T20:17:53.110Z",
  "pubdate": "2026-08-12T20:17:53.110Z",
  "executiveSummary": "SiYuan versions <= v3.7.2 contain an authentication bypass vulnerability residing in the kernel's CheckAuth function.\nThe vulnerability grants the administrator role (RoleAdministrator) to any incoming request where the RemoteAddr originates from the loopback interface (127.0.0.1) across a specific set of sensitive endpoints.\nAffected endpoints include /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*.\nThese localhost bypasses operate entirely outside the access auth code gate, meaning they bypass authentication checks even when an access token is explicitly configured.\nBecause the fixed-port reverse proxy forwards requests to the kernel over the loopback interface without injecting an authentication token and fails to configure trusted proxies, any request routed through this proxy reaches the kernel with a loopback RemoteAddr.\nIf the fixed-port proxy is bound to a network interface, a remote unauthenticated attacker can potentially exploit this architectural flaw to obtain full administrative access over the targeted endpoints.\nThe risk implications involve complete authorization bypass and unauthorized administrative control over sensitive system functionalities.",
  "technicalDetails": "The root cause of the vulnerability lies within the kernel's CheckAuth function in SiYuan versions <= v3.7.2.\nThe function implements logic that automatically assigns the administrator role (RoleAdministrator) to requests arriving from the loopback address (127.0.0.1).\nThis check is performed for a defined set of endpoints, namely /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*.\nThese validation mechanisms are positioned outside the standard access auth code gate, causing them to execute and grant elevated privileges regardless of whether a system access authentication code has been configured by the administrator.\nThe exploitation vector heavily relies on the application's fixed-port reverse proxy architecture.\nThe fixed-port reverse proxy forwards client requests directly to the backend kernel over the loopback interface without inserting an authentication token.\nAdditionally, the proxy implementation lacks proper trusted proxy configuration handling.\nConsequently, when a request hits the proxy—provided the fixed-port proxy is bound to an accessible network interface—it is forwarded to the kernel such that the kernel observes the RemoteAddr as 127.0.0.1.\nThis tricks the CheckAuth function into treating the remote request as a trusted local request.\nAs a result, unauthenticated remote attackers can send crafted HTTP requests directly to the exposed proxy or application endpoints.\nThe kernel evaluates the loopback RemoteAddr, bypasses the authentication gate entirely, and processes the execution flow with RoleAdministrator privileges.\nThis grants the attacker unauthorized administrative capabilities over affected functions such as system exit, network configuration retrieval, workspace information disclosure, asset retrieval, and data export operations."
}