SiYuan versions up to and including v3.7.2 contain an authentication bypass vulnerability in the kernel's CheckAuth function. This flaw grants administrator privileges to any request originating from the loopback address (127.0.0.1) for certain endpoints, bypassing access auth codes. The vulnerability can potentially be exploited remotely via a fixed-port reverse proxy that forwards requests over loopback without proper authentication token injection or trusted proxy configuration. The issue was patched in version v3.7.4. This advisory is a duplicate and has been withdrawn in favor of GHSA-3mp7-4rh5-jrv9.