CVE-2026-66012 affects SiYuan note-taking software versions before 3.7.2. The vulnerability arises from a missing authorization check on the POST /mcp kernel endpoint, which is protected only by a general auth check without role enforcement. This endpoint exposes numerous MCP tools, including file operations across the workspace. If the Publish server is configured in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the reverse proxy attaches an anonymous RoleReader JWT to requests, enabling remote unauthenticated attackers to access /mcp. Attackers can read the conf/conf.json file to obtain sensitive secrets such as accessAuthCode, api.token, and cookieKey in plaintext. They can also write arbitrary files and plant malicious plugins in data/plugins/ that run with nodeIntegration:true and no contextIsolation on the next desktop launch, resulting in full administrator compromise.

The vulnerability allows remote unauthenticated attackers to bypass authorization controls and perform sensitive file operations including reading configuration files containing secrets and writing arbitrary files. This can lead to planting malicious plugins that execute with high privileges, resulting in complete administrator takeover of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling the Publish server in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false) to prevent exposure. Monitor vendor channels for updates and apply any official patches once released.