Unauthenticated WebSocket Vulnerability in SiYuan Knowledge Management System

CVE-2026-32815

What is CVE-2026-32815?

SiYuan, a personal knowledge management system, allows unauthenticated connections through its WebSocket endpoint in versions 3.6.0 and lower. When certain URL parameters are used, this vulnerability enables any external client, including malicious sites leveraging cross-origin WebSocket technology, to connect and receive real-time server push events. These events can expose sensitive document metadata, such as titles and paths, as well as all CRUD operations performed by authenticated users. The absence of Origin header validation compounds this issue, allowing attackers to monitor a victim's activities within SiYuan. This vulnerability has been addressed in version 3.6.1.

References