Unauthenticated Access in SiYuan Personal Knowledge Management System
CVE-2026-54069

9.2CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
24 June 2026

What is CVE-2026-54069?

SiYuan Note, an open-source personal knowledge management system, contains a vulnerability that allows unauthorized access to its kernel API. Prior to version 3.7.0, the kernel HTTP server of SiYuan Note unconditionally trusted all origins from chrome-extension://, effectively allowing any installed browser extension to gain RoleAdministrator access without proper authentication. This design flaw, coupled with a default empty AccessAuthCode in desktop versions, poses a serious risk, as it can enable malicious extensions, including those compromised through supply chain attacks, to perform fully authenticated admin operations. Consequently, attackers could exfiltrate data, execute stored cross-site scripting (XSS), and tamper with system configurations. Users are encouraged to update to the latest version to mitigate these risks.

Affected Version(s)

siyuan < 3.7.0

References

https://github.com/siyuan-note/siyuan/security/advisories...
x_refsource_CONFIRM

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.