CVE-2026-74867 describes a CSRF vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability arises because the session-cookie authentication branch of the CheckAuth() function lacks validation of the Origin or Referer HTTP headers and does not explicitly set the SameSite attribute on session cookies. Without these protections, browsers rely on default SameSite policies, which may allow cross-site requests to carry valid session cookies. An attacker can exploit this by creating malicious web pages that submit unauthorized requests on behalf of authenticated users, potentially causing unintended actions within the application.

An attacker can perform unauthorized actions on behalf of authenticated users by exploiting the lack of Origin/Referer validation and missing SameSite cookie attributes. However, the CVSS score of 2.3 and the 'low' severity rating indicate that the impact is limited, likely requiring user interaction and having high attack complexity.

No official patch or remediation level is currently documented. Users should monitor vendor advisories for updates or patches addressing this vulnerability. In the meantime, applying web application firewall rules to detect and block CSRF attempts or implementing manual mitigations such as enforcing Origin/Referer checks and setting SameSite cookie attributes in custom deployments may reduce risk.