CVE-2026-66012

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2

Description A missing authorization issue exists in the 'POST /mcp' kernel endpoint, which is only protected by a general authentication check model.CheckAuth() without enforcing admin roles or read-only restrictions. This flaw exposes 31 MCP tools, including a file tool capable of listing, reading, writing, deleting, renaming, and copying files across the entire workspace. If the Publish server is configured in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the reverse proxy attaches an anonymous RoleReader JWT to requests, enabling unauthenticated remote attackers to access the endpoint. An attacker can extract accessAuthCode, api.token, and cookieKey in plaintext from conf/conf.json, write arbitrary files, and install a malicious plugin in data/plugins/ that executes with nodeIntegration:true and no contextIsolation upon the next desktop launch, resulting in full administrator takeover.

Recommendations Update to version 3.7.2 or later. As a temporary mitigation, disable the Publish server anonymous mode by setting Conf.Publish.Enable=false or Conf.Publish.Auth.Enable=true.