CVE-2026-32815

Katalog CVE

CVSS 7.5 · High EPSS 0,53%

Kerentanan Improper Authentication pada b3log siyuan. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are provided (?app=siyuan&id=auth&type=auth). This bypass, intended for the login page to keep the kernel alive, allows any external client — including malicious websites via cross-origin WebSocket — to connect and receive all server push events in real-time. These events leak sensitive document metadata including document titles, notebook names, file paths, and all CRUD operations performed by authenticated users. Combined with the absence of Origin header validation, a malicious website can silently connect to a victim's local SiYuan instance and monitor their note-taking activity. This issue has been fixed in version 3.6.1.

Rincian

Terbit di NVD

19 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6 exploit · mitigasi · advisory vendor
• https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3 patch
• https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 release notes