CVE-2026-100634: Missing Authorization in siyuan-note siyuan
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.
AI Analysis
Technical Summary
CVE-2026-100634 describes a missing authorization vulnerability in SiYuan note software prior to version 3.8.4. The 'siyuan-send-windows' IPC handler does not validate the sender or restrict message recipients, forwarding payloads to all BrowserWindow instances, including those from other workspaces. An attacker controlling a remote kernel connected to a renderer can send commands such as {cmd: "lockscreenByMode"} that cause sibling workspace windows to invoke lockScreen(), leading to repeated locking and a limited denial of service. No other impacts such as confidentiality loss, integrity compromise, or code execution were observed.
Potential Impact
The vulnerability allows an attacker with access to a remote kernel connected to a renderer process to cause unrelated workspace windows in SiYuan to lock repeatedly, resulting in a limited denial of service. There is no observed impact on confidentiality, integrity, or code execution.
Mitigation Recommendations
Upgrade SiYuan to version 3.8.4 or later where this authorization issue is fixed. Since the vulnerability is patched in v3.8.4, applying this official fix fully mitigates the issue.
CVE-2026-100634: Missing Authorization in siyuan-note siyuan
Description
SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process (app/electron/main.js). The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows(), including windows belonging to other opened workspaces. A renderer connected to an attacker-controlled remote kernel can therefore send {cmd: "lockscreenByMode"} and have it delivered across the workspace boundary; a sibling workspace window whose lockScreenMode is set to 1 invokes lockScreen(). Repeated messages allow the remote workspace to repeatedly lock unrelated local workspace windows, causing a limited denial of service. No confidentiality, integrity, or code-execution impact was observed.
CVSS v4.0
Score 5.3medium
Affected software
siyuan-note
siyuan
pkg:github/siyuan-note/siyuanRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-100634 describes a missing authorization vulnerability in SiYuan note software prior to version 3.8.4. The 'siyuan-send-windows' IPC handler does not validate the sender or restrict message recipients, forwarding payloads to all BrowserWindow instances, including those from other workspaces. An attacker controlling a remote kernel connected to a renderer can send commands such as {cmd: "lockscreenByMode"} that cause sibling workspace windows to invoke lockScreen(), leading to repeated locking and a limited denial of service. No other impacts such as confidentiality loss, integrity compromise, or code execution were observed.
Potential Impact
The vulnerability allows an attacker with access to a remote kernel connected to a renderer process to cause unrelated workspace windows in SiYuan to lock repeatedly, resulting in a limited denial of service. There is no observed impact on confidentiality, integrity, or code execution.
Mitigation Recommendations
Upgrade SiYuan to version 3.8.4 or later where this authorization issue is fixed. Since the vulnerability is patched in v3.8.4, applying this official fix fully mitigates the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-26T02:31:42.100Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab7c9a5f7a7c5410652fd1d
Added to database: 09/26/2026, 13:33:25 UTC
Last enriched: 09/26/2026, 14:04:16 UTC
Last updated: 09/27/2026, 01:57:11 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.