VYPR
Published Aug 18, 2026· Updated Aug 19, 2026· 1 source

Siyuan Note: 25 Vulnerabilities Including RCE and Auth Bypass Disclosed Together

Key findings • 25 vulnerabilities in Siyuan Note disclosed together, patched in v3.7.4. • Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities. • Wid…

Key findings

  • 25 vulnerabilities in Siyuan Note disclosed together, patched in v3.7.4.
  • Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities.
  • Widespread failure to enforce publish-access controls across numerous API endpoints led to information disclosure.
  • Server-side template injection and SSRF vulnerabilities were also identified.
  • Users must update to v3.7.4 to mitigate severe security risks.

On August 15, 2026, a significant batch of 25 vulnerabilities was disclosed for Siyuan Note, a popular note-taking application. These vulnerabilities, all patched in version v3.7.4, primarily revolve around authentication bypass, information disclosure, and cross-site scripting (XSS) flaws, with several critical and high-severity issues identified. The disclosures span from August 14th to August 18th, highlighting a concentrated period of vulnerability reporting for the product.

A major theme across many of these vulnerabilities is the improper handling of authorization and authentication. For instance, CVE-2026-74906 and CVE-2026-74904 detail how certain publish-mode reader-facing endpoints and block metadata/content endpoints lacked proper authorization checks, allowing anonymous users to access restricted content. Similarly, CVE-2026-73054 describes an authentication bypass in the WebSocket endpoint due to differential parsing of query parameters. The CheckAuth middleware itself is implicated in CVE-2026-73053 and CVE-2026-74903, with vulnerabilities stemming from insufficient access control and missing role checks, respectively.

Several critical vulnerabilities leverage cross-site scripting (XSS) to achieve code execution. CVE-2026-74800, a critical flaw, allows stored XSS via uploaded HTML files due to missing security headers. CVE-2026-73053 and CVE-2026-73052 describe XSS vulnerabilities in document icons and the sort menu, respectively, which can lead to arbitrary code execution due to Node integration. Further XSS issues are detailed in CVE-2026-73050, CVE-2026-73044, and CVE-2026-73043, exploiting unescaped render sites, table column widths, and database menu metadata.

Remote code execution (RCE) is a significant concern, with multiple CVEs detailing pathways to compromise. CVE-2026-74801 describes an RCE vulnerability through a malicious workspace directory path. CVE-2026-73043 points to RCE via template calculation operators rendering user-authored Go templates. Additionally, CVE-2026-74799, a critical vulnerability, allows attackers to access unauthenticated debug endpoints like pprof, potentially extracting sensitive secrets such as API keys.

Other notable vulnerabilities include Server-Side Request Forgery (SSRF) in CVE-2026-74905, path traversal in CVE-2026-74798, and unthrottled brute-force attacks against the Publish Service in CVE-2026-74868. Cross-Site Request Forgery (CSRF) is also present in CVE-2026-74867 due to a lack of Origin/Referer validation.

All 25 vulnerabilities were addressed in Siyuan Note version v3.7.4. Users are strongly advised to update to this version to mitigate the risks associated with these critical and high-severity flaws, which include RCE, XSS, authentication bypass, and information disclosure. The widespread nature of these vulnerabilities underscores the importance of timely patching and security updates for Siyuan Note users.

The batch of vulnerabilities was disclosed on August 15, 2026, with individual CVEs published between August 14 and August 18, 2026. The affected product is Siyuan Note, with all issues patched in version v3.7.4. The primary impact of these vulnerabilities includes unauthorized access to sensitive information, execution of arbitrary code, and potential system compromise.

Key findings from this disclosure include:

  • A large batch of 25 vulnerabilities affecting Siyuan Note were disclosed together, patched in v3.7.4.
  • Critical flaws include RCE, XSS, and authentication bypass, impacting core functionalities.
  • Widespread failure to enforce publish-access controls across numerous API endpoints led to information disclosure.
  • Server-side template injection and SSRF vulnerabilities were also identified.
  • Users must update to v3.7.4 to mitigate severe security risks.

The vulnerabilities disclosed are: CVE-2026-74906, CVE-2026-74905, CVE-2026-74904, CVE-2026-74903, CVE-2026-74902, CVE-2026-74868, CVE-2026-74867, CVE-2026-74802, CVE-2026-74801, CVE-2026-74800, CVE-2026-74799, CVE-2026-74798, CVE-2026-73056, CVE-2026-73054, CVE-2026-73053, CVE-2026-73052, CVE-2026-73050, CVE-2026-73047, CVE-2026-73046, CVE-2026-73045, CVE-2026-73044, CVE-2026-73043, CVE-2026-73042, CVE-2026-73041, CVE-2026-73630. *Vypr Intelligence reported on this batch of vulnerabilities on August 15, 2026.*

Synthesized by Vypr AI