Medium severity4.2NVD Advisory· Published Aug 17, 2026· Updated Aug 26, 2026

CVE-2026-74867

Description

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Siyuan Note/Siyuanllm-fuzzy
Range: <3.7.4

Patches

Vulnerability mechanics

References

github.com/siyuan-note/siyuan/security/advisories/GHSA-hhm2-g993-p656nvd
www.vulncheck.com/advisories/siyuan-before-cross-site-request-forgery-via-checkauthnvd

News mentions

Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together
Vypr Intelligence · Aug 18, 2026

cvss	0.273
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000