CVE-2026-74867 describes a CSRF vulnerability in SiYuan note-taking software prior to version 3.7.4. The issue exists in the session-cookie authentication branch of the CheckAuth() function, which does not validate the Origin or Referer headers and does not set an explicit SameSite attribute on session cookies. This allows attackers to exploit browser default SameSite cookie handling to submit unauthorized requests using valid session cookies of authenticated users.

An attacker can induce an authenticated user to visit a malicious web page that submits unauthorized requests to the SiYuan application, potentially causing actions to be performed without the user's consent. The impact is limited by the requirement for user interaction and the high attack complexity, reflected in the low CVSS score of 2.3.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should be cautious about visiting untrusted websites while authenticated to SiYuan and consider using browser extensions or settings that enforce stricter CSRF protections.