/Vulnerability Library

SiYuan Note <= 3.6.5 - Authentication Bypass

CVE-2026-54069
Verified

Description

SiYuan Note 3.6.5 and prior is vulnerable to authentication bypass. The CheckAuth middleware unconditionally trusted all chrome-extension:// origins, granting RoleAdministrator access without token validation to any request with a spoofed Origin header. Fixed in v3.7.0.

Severity

High

CVSS Score

9.1

Exploit Probability

7%

Affected Product

siyuan

Published Date

June 17, 2026

Template Author

0x_akoko

CVE-2026-54069.yaml
9.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID:
cve-2026-54069
CWE ID:
cwe-346

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hvr9-72v2-fff3https://nvd.nist.gov/vuln/detail/CVE-2026-54069

Remediation Steps

Update to SiYuan Note v3.7.0 or later.