Critical Remote Takeover Flaw in SiYuan Note-Taking App Affects Unauthenticated Users

A critical missing authorization vulnerability in SiYuan versions prior to 3.7.2 allows remote attackers to bypass authentication and take full control of the application when the Publish server is configured for anonymous access.

Key Points:

• CVE-2026-66012 is a critical vulnerability with a CVSS score of 10 affecting SiYuan versions before v3.7.2.
• The flaw allows unauthenticated remote attackers to access restricted MCP tools via the /mcp kernel endpoint.
• Exploitation requires the Publish server to be enabled in anonymous mode, which attaches an anonymous JWT to requests.
• Attackers can read sensitive configuration files and plant malicious plugins to achieve full administrator takeover.
• The issue is resolved in SiYuan v3.7.2 and later versions.

A critical security flaw has been identified in SiYuan, a popular note-taking and knowledge base application, specifically in versions prior to v3.7.2. The vulnerability, tracked as CVE-2026-66012, stems from a missing authorization check on the POST /mcp kernel endpoint. This endpoint is intended to be protected by authentication functions that enforce specific admin-role or read-only permissions, but these checks fail to restrict access properly. As a result, the endpoint exposes 31 Model Context Protocol (MCP) tools that should be restricted to authorized users only.

The vulnerability can be exploited remotely without any prior authentication, but it requires a specific configuration on the target instance. The attack is successful only when the SiYuan Publish server is enabled and configured for anonymous access. In this state, the Publish reverse proxy automatically attaches an anonymous RoleReader JWT to proxied requests, effectively bypassing the intended security controls. Once an attacker gains access to the MCP tools, they can utilize a file management utility to read, write, delete, and copy files across the entire workspace.

The impact of this breach is severe, leading to complete administrator takeover of the desktop application. Attackers can extract plaintext credentials from sensitive configuration files, such as accessAuthCode and api.token. Furthermore, the ability to write arbitrary files allows attackers to plant malicious plugins in the data/plugins/ directory. When the SiYuan desktop application is launched, these plugins execute with high privileges due to nodeIntegration being enabled and context isolation being disabled, granting the attacker full control over the underlying system. Users are advised to update to SiYuan v3.7.2 or later immediately to mitigate this risk.

Have you enabled anonymous access for the Publish server in your SiYuan instance, and are you currently running version 3.7.2 or newer?

Learn More: The Hacker Wire

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)