{"id":"CVE-2026-72809","title":"SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0…","summary":"SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0…","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H","cwe":["CWE-290"],"published":"2026-08-12","updated":"2026-08-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72809","references":[{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3mp7-4rh5-jrv9","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-localhost-trust","label":"disclosure@vulncheck.com"},{"url":"https://github.com/siyuan-note/siyuan/security/advisories/GHSA-3mp7-4rh5-jrv9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72809"},{"url":"https://github.com/siyuan-note/siyuan/commit/9c16e9851f0b5d7ed179e5c2fca15a7724666871"},{"url":"https://github.com/siyuan-note/siyuan"}],"tags":["nvd","osv","go"],"epss":0.00206,"epssPercentile":0.11053,"ingestedAt":"2026-08-15T21:29:27.245Z","aliases":["GHSA-3mp7-4rh5-jrv9","GO-2026-6386"],"ecosystem":"go","vendor":"siyuan-note","product":"github.com/siyuan-note/siyuan/kernel","affected":["github.com/siyuan-note/siyuan/kernel < 0.0.0-20260723031701-9c16e9851f0b"],"patched":["github.com/siyuan-note/siyuan/kernel 0.0.0-20260723031701-9c16e9851f0b"],"slug":"CVE-2026-72809","body":"## Overview\n\nSiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request whose RemoteAddr is loopback (127.0.0.1) for a specific set of endpoints (including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*). These localhost bypasses sit outside the access auth code gate, so they apply even when an access auth code is configured. Because the fixed-port reverse proxy forwards requests to the kernel over loopback without injecting an authentication token and does not configure trusted proxies, a request forwarded through this proxy reaches the kernel with RemoteAddr = 127.0.0.1. If the fixed-port proxy is bound to a network interface, this could allow a remote unauthenticated attacker to obtain admin access on the affected endpoints; however, per the advisory this remote forwarding behavior was established only by code inspection and was not reproduced end-to-end.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-72809)\n\nAffected packages:\n\n- `github.com/siyuan-note/siyuan/kernel < 0.0.0-20260723031701-9c16e9851f0b`\n\nPatched in:\n\n- `github.com/siyuan-note/siyuan/kernel 0.0.0-20260723031701-9c16e9851f0b`\n\nSource: https://osv.dev/vulnerability/GHSA-3mp7-4rh5-jrv9","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}