A missing authorization flaw in SiYuan before v3.7.2 lets a remote unauthenticated attacker reach the /mcp kernel endpoint and seize full administrator control of the workspace.
What Is It
CVE-2026-66012 is a missing authorization vulnerability (CWE-862) in the POST /mcp kernel endpoint of the SiYuan note-taking application. The endpoint is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement, exposing 31 MCP tools; including a file tool with list, read, write, delete, rename, and copy actions across the entire workspace.
When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch; leading to administrator takeover.
Why It Matters
This is rated CVSS 3.1 10.0 (CRITICAL): network-exploitable, low complexity, no privileges, no user interaction, with a changed scope and high confidentiality, integrity, and availability impact (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). The CVSS 4.0 score is likewise 10.0. Successful exploitation yields plaintext credential theft, arbitrary file write, and code execution on the next desktop launch, culminating in full administrator takeover.
The supplied CISA KEV entry is empty, so there is no confirmation of active exploitation in the provided data.
What's Vulnerable
- Vendor/product: siyuan-note / siyuan
- Affected: all versions before 3.7.2
- Fixed: version 3.7.2 (unaffected)
Exposure requires the Publish server running in anonymous mode.
Patch Status
Upgrade to SiYuan v3.7.2 or later, which addresses the flaw. A remediation commit is available (c72ca4c), along with the vendor security advisory.