In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in… (CVE-2026-100646)
SiYuan versions up to and including 3.8.3 contain a vulnerability in the kernel's authentication guards that fail open when the HTTP Origin header is missing. This allows cross-site GET requests from attacker-controlled pages to gain administrator privileges due to incorrect assumptions about the presence of the Origin header. The vulnerability also involves content-type sniffing on an API endpoint, enabling remote attackers to execute arbitrary scripts within the SiYuan origin and exfiltrate persistent API tokens. The issue is fixed in version 3.8.4.
AI Analysis
Technical Summary
SiYuan, a self-hosted personal knowledge management system, has an authentication bypass vulnerability (CVE-2026-100646) in versions up to and including 3.8.3. The kernel's authentication guards (CheckAuth and IsSessionOriginAllowed) incorrectly allow requests missing the HTTP Origin header, assuming all browser-initiated cross-site requests include it. Browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads, and since the session cookie is SameSite=Lax, a single cross-site GET from an attacker-controlled page is granted RoleAdministrator. Additionally, content-type sniffing on the /api/network/proxy endpoint allows attacker-controlled HTML to be served under SiYuan's origin, enabling script execution, administrator API invocation, and exfiltration of the persistent kernel API token. This vulnerability is resolved in SiYuan version 3.8.4.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to gain administrator privileges via cross-site GET requests due to the failure of authentication guards when the Origin header is absent. This leads to arbitrary script execution within the SiYuan origin, unauthorized invocation of administrator APIs, and exfiltration of persistent kernel API tokens. Both default installations without access-authorization code and password-protected instances with live sessions are affected.
Mitigation Recommendations
This vulnerability is fixed in SiYuan version 3.8.4. Users should upgrade to version 3.8.4 or later to remediate the issue. No other mitigation actions are indicated in the available data.
In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in… (CVE-2026-100646)
Description
SiYuan versions up to and including 3.8.3 contain a vulnerability in the kernel's authentication guards that fail open when the HTTP Origin header is missing. This allows cross-site GET requests from attacker-controlled pages to gain administrator privileges due to incorrect assumptions about the presence of the Origin header. The vulnerability also involves content-type sniffing on an API endpoint, enabling remote attackers to execute arbitrary scripts within the SiYuan origin and exfiltrate persistent API tokens. The issue is fixed in version 3.8.4.
CVSS v3.1
Score 8.1high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SiYuan, a self-hosted personal knowledge management system, has an authentication bypass vulnerability (CVE-2026-100646) in versions up to and including 3.8.3. The kernel's authentication guards (CheckAuth and IsSessionOriginAllowed) incorrectly allow requests missing the HTTP Origin header, assuming all browser-initiated cross-site requests include it. Browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads, and since the session cookie is SameSite=Lax, a single cross-site GET from an attacker-controlled page is granted RoleAdministrator. Additionally, content-type sniffing on the /api/network/proxy endpoint allows attacker-controlled HTML to be served under SiYuan's origin, enabling script execution, administrator API invocation, and exfiltration of the persistent kernel API token. This vulnerability is resolved in SiYuan version 3.8.4.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to gain administrator privileges via cross-site GET requests due to the failure of authentication guards when the Origin header is absent. This leads to arbitrary script execution within the SiYuan origin, unauthorized invocation of administrator APIs, and exfiltration of persistent kernel API tokens. Both default installations without access-authorization code and password-protected instances with live sessions are affected.
Mitigation Recommendations
This vulnerability is fixed in SiYuan version 3.8.4. Users should upgrade to version 3.8.4 or later to remediate the issue. No other mitigation actions are indicated in the available data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r2fg-xpcg-8v48
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-100646"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab89be4f7a7c5410694206b
Added to database: 09/27/2026, 04:30:28 UTC
Last enriched: 09/27/2026, 04:32:50 UTC
Last updated: 09/27/2026, 04:32:50 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.