CVE-2026-66012 describes a missing authorization vulnerability in SiYuan note-taking software before version 3.7.2. The POST /mcp kernel endpoint is protected only by a general authentication check without role enforcement, exposing multiple MCP tools that allow file operations across the workspace. If the Publish server is configured in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the reverse proxy attaches an anonymous RoleReader JWT to proxied requests, enabling remote unauthenticated attackers to access /mcp. Attackers can read the conf/conf.json file to extract sensitive secrets such as accessAuthCode, api.token, and cookieKey in plaintext. They can also write arbitrary files, including planting a plugin in data/plugins/ that runs with nodeIntegration:true and no contextIsolation on the next desktop launch, resulting in complete administrator takeover.

An attacker can remotely and without authentication access the /mcp endpoint, bypassing intended authorization controls. This allows reading sensitive configuration files containing secrets, writing arbitrary files in the workspace, and planting malicious plugins that execute with high privileges. The ultimate impact is full administrator compromise of the affected SiYuan installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling the Publish server in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false) to reduce exposure. Restrict access to the /mcp endpoint and monitor for unauthorized activity. Follow vendor guidance once published for applying official patches or temporary mitigations.