CVE-2026-32815— SiYuan 授权问题漏洞

SiYuan: Cross-Origin WebSocket Hijacking via Authentication Bypass — Unauthenticated Information Disclosure

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are provided (?app=siyuan&id=auth&type=auth). This bypass, intended for the login page to keep the kernel alive, allows any external client — including malicious websites via cross-origin WebSocket — to connect and receive all server push events in real-time. These events leak sensitive document metadata including document titles, notebook names, file paths, and all CRUD operations performed by authenticated users. Combined with the absence of Origin header validation, a malicious website can silently connect to a victim's local SiYuan instance and monitor their note-taking activity. This issue has been fixed in version 3.6.1.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

认证机制不恰当

SiYuan 授权问题漏洞

SiYuan是SiYuan开源的一个隐私至上的个人知识管理系统。 SiYuan 3.6.0及之前版本存在授权问题漏洞，该漏洞源于WebSocket端点允许未经身份验证的连接，可能导致敏感文档元数据泄露。

N/A

N/A