EUVD-2026-330238

fkie_cve-2026-54069

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, granting RoleAdministrator access to every installed browser extension without any authentication. Combined with the default empty AccessAuthCode on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at 127.0.0.1:6806, enabling data exfiltration, stored XSS injection, and configuration tampering. This vulnerability is fixed in 3.7.0.

GHSA-hvr9-72v2-fff3 — SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist

Affected: Go: github.com/siyuan-note/siyuan/kernel

## Summary

SiYuan Note's kernel HTTP server unconditionally trusts all `chrome-extension://` origins, granting `RoleAdministrator` access to every installed browser extension without any authentication. Combined with the default empty `AccessAuthCode` on desktop installs, any Chrome/Chromium extension -- including a compromised legitimate extension via supply chain attack -- can make fully authenticated admin API calls to the SiYuan kernel at `127.0.0.1:6806`, enabling data exfiltration, stored XSS injection, and configuration tampering.

## Affected Versions

SiYuan <= v3.6.5 (commit `96dfe0bea474`). The chrome-extension allowlist remains unfixed as of the latest commit on the fix branch (`d7b77d945e0d`).

## Vulnerability Details

### Blanket chrome-extension:// Origin Trust (CWE-346)

In `kernel/model/session.go:277`, the `CheckAuth` middleware exempts all `chrome-extension://` origins from authentication:

```go if strings.HasPrefix(origin, "chrome-extension://") { // skip auth } ```

At `session.go:284`, the request is assigned `RoleAdministrator`:

```go c.Set("role", model.RoleAdministrator) ```

The `AccessAuthCode` field defaults to an empty string for desktop installs (`ContainerStd`). When empty, no token validation occurs. This means **any** Chrome/Chromium extension can make fully authenticated admin API calls to the SiYuan kernel.

The origin check trusts the entire `chrome-extension://` scheme rather than validating a specific extension ID, so every insta…

Most recent entries from all

EUVD-2026-330238

fkie_cve-2026-54069

GHSA-hvr9-72v2-fff3 — SiYuan: Unauthenticated Admin API Access via Blanket chrome-extension:// Origin Allowlist