CVE-2026-73054
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
SiYuan before v3.7.4 contains an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.
Risk Assessment
Risk of exposing sensitive information about documents and user operations in SiYuan, potentially compromising privacy and data security.
Recommendation
Update SiYuan to version 3.7.4 or later, which includes the fix. Restrict WebSocket endpoint access to trusted networks only.
Original NVD description (English source)
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the WebSocket endpoint caused by differential parsing of query parameters between authentication exemption and session quarantine checks. Unauthenticated attackers can craft a malicious WebSocket URI with duplicated query parameters to bypass access auth code validation and receive the live kernel event stream including document identifiers, titles, and operation logs.