Critical SiYuan Flaw Enables Admin Takeover

SiYuan versions prior to 3.7.2 contain a critical missing authorization vulnerability in the POST /mcp kernel endpoint. This flaw allows remote, unauthenticated attackers to execute arbitrary commands, read sensitive configuration files, and gain full administrative control over the affected application.

What's at Risk

The vulnerability affects all SiYuan installations prior to version 3.7.2. Organizations or individuals running SiYuan with the Publish server enabled in anonymous mode are at the highest risk. When this specific configuration is active, the system's reverse proxy incorrectly assigns an anonymous role to unauthenticated requests, bypassing the intended security checks for the MCP kernel endpoint.

Systems that are exposed to the public internet using these insecure configuration settings are particularly vulnerable to immediate exploitation. Because the flaw allows for the extraction of sensitive secrets, such as API tokens and authentication keys, any deployment that is accessible to unauthorized network traffic should be considered compromised until remediated.

How the Flaw Works

This vulnerability is categorized as a missing authorization flaw. In general, this class of security weakness occurs when an application performs a high-level authentication check but fails to verify if the user has the specific permissions required to perform sensitive actions. When an application exposes powerful internal tools—such as file system manipulation or code execution—without granular access control, an attacker can leverage those tools to bypass the intended security model entirely.

Typically, attackers exploit these weaknesses by sending crafted requests to restricted endpoints that the server assumes are only accessible to authorized administrators. By successfully interacting with these endpoints, an attacker can often perform unauthorized operations, such as reading configuration files, modifying system data, or planting malicious code that executes with elevated privileges. This often leads to a complete system takeover, as the attacker effectively inherits the permissions of the application's core processes.

How to Protect Your Systems

• Update your SiYuan installation to version 3.7.2 or later immediately to include the vendor-provided security patches.
• Disable the Publish server if it is not strictly required for your current operations, especially if you are using anonymous mode.
• Audit your current configuration settings to ensure that authentication is explicitly enabled for all public-facing or shared services.
• Restrict network access to your SiYuan instance by placing it behind a VPN or a firewall that limits exposure to trusted IP addresses only.
• Monitor system logs for unauthorized attempts to access the /mcp endpoint or unusual file system activity within your workspace directory.

Given the CVSS score of 10, this vulnerability represents the highest level of risk to your environment. The ability for an attacker to achieve unauthenticated administrator takeover means that data confidentiality, integrity, and availability are all at risk. Promptly applying the vendor's patch is the only reliable way to close this security gap and prevent potential exploitation of your workspace.