Kernel: Duplicate Advisory: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port prox

The kernel component of SiYuan versions <= v3.7.2 has an authentication bypass vulnerability in its CheckAuth function. Requests with a RemoteAddr of 127.0.0.1 are automatically granted the administrator role for specific endpoints, including /api/system/exit, getNetwork, getWorkspaceInfo, /assets/*, and /export/*. This bypass occurs even when access auth codes are configured. A fixed-port reverse proxy forwards requests to the kernel over loopback without injecting authentication tokens and lacks trusted proxy configuration, potentially allowing remote unauthenticated attackers to gain admin access if the proxy is bound to a network interface. However, remote exploitation was not confirmed through end-to-end testing. The vulnerability is fixed in SiYuan v3.7.4.

An attacker able to send requests that appear to originate from the loopback interface can gain administrator privileges on affected endpoints, bypassing authentication controls. This could lead to high confidentiality impact, limited integrity impact, and high availability impact as per the CVSS vector. Remote exploitation is theoretically possible via the fixed-port proxy but was not demonstrated in practice.

Upgrade SiYuan to version v3.7.4 or later where this vulnerability is patched. Since this advisory is a duplicate and the original GHSA-3mp7-4rh5-jrv9 should be referenced for updates, ensure to follow vendor guidance from that advisory. No other mitigations are specified.