What’s Vulnerable › Vulnerabilities

CVE-2026-100642: SiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-26 · updated 2026-09-30
• Weakness: CWE-346

Description

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.

Affected products

• siyuan-note siyuan: from 2.1.0 before 3.8.4 — fixed in 3.8.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.8.4. Check the vendor advisory for mitigations.

References

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m
• https://www.vulncheck.com/advisories/siyuan-2.1.0-before-3.8.4-cross-site-request-forgery-via-checkauth
• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-9gpj-3rm3-x42m

Get alerted when CVE-2026-100642 or the next vulnerability affects your stack