rootpwn

critical · CVSS v3 7.6 · CVSS v4 7.2

CVE-2026-100642

SiYuan versions before 3.8.4 are vulnerable to a CSRF flaw that allows attackers to gain administrative privileges via loopback requests. Th

Overview

SiYuan versions before 3.8.4 are vulnerable to a CSRF flaw that allows attackers to gain administrative privileges via loopback requests. The flaw bypasses Origin header checks in the lock‑screen authentication flow, enabling malicious web pages to trigger privileged actions from a victim’s browser. This can lead to unauthorized configuration changes and process termination.

Description

SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branch that grants administrator access to loopback requests without validating Origin headers. Attackers can craft malicious web pages that force victims to terminate the kernel process, read workspace configuration and proxy settings, and trigger administrative actions via zero-credential cross-origin requests from the victim's browser.

Impact

The vulnerability allows attackers to elevate privileges to administrator, compromising confidentiality of workspace data, integrity of configuration, and availability by terminating kernel processes. Administrators and users of affected SiYuan installations are at risk of unauthorized configuration changes and service disruption.

Remediation

Apply the official patch by upgrading to SiYuan v3.8.4 or later. If upgrading is not immediately possible, block local loopback requests to the application, enforce strict Origin header validation, disable the lock‑screen pass‑through feature, and restrict the application’s network access via firewall rules. Monitor for abnormal administrative actions and audit logs for signs of exploitation.

Risk context

This is a critical‑severity vulnerability with a CVSS v3 score of 7.6. The lack of an EPSS score indicates no current predictive data, but the high severity and potential for privilege escalation warrant prompt remediation.

Affected products

  • SiYuan v2.1.0
  • SiYuan v2.1.1
  • SiYuan v2.2.0
  • SiYuan v3.0.0
  • SiYuan v3.1.0
  • SiYuan v3.5.0
  • SiYuan v3.7.0
  • SiYuan v3.8.3

Scores

Severity
critical
CVSS v2
9
CVSS v3
7.6
CVSS v4
7.2
EPSS
—

CSRF SiYuan critical admin-privilege lock-screen origin-header cross-origin vulnerability

← All CVEs

Related CVEs

critical

CVE-2026-100671

Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.

View analysis

critical

CVE-2026-18143

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the `afrfq_submit_quote_via_popup()` function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw attacker-supplied filename directly as the destination for `move_uploaded_file()`. This makes it possible for unauthenticated attackers to upload executable files, such as PHP files, to a web-accessible temporary RFQ upload directory when a public quote rule with the multi-page popup flow is enabled.

View analysis

critical

CVE-2026-96524

The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated requests when a condition an attacker can influence is present, allowing unauthenticated attackers to perform administrator-only actions, including creating a new administrator account, by tricking a logged-in administrator into visiting a crafted page.

View analysis

critical

CVE-2026-100606

Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callback arrives with an email matching a user whose status is INVITED, verifyAndLogin (SSOBase.ts:80-94) copies the user record from the database — including the server-stored single-use invitation tempToken — into the data passed to AccountService.register(). The register handler's token lookup, email match, and expiry checks therefore pass trivially against the server's own token instead of a caller-supplied one, and the account and its organization membership are flipped to ACTIVE. As a result, anyone able to authenticate at any configured SSO provider using a pending invitee's email address as the email claim can take over that invitation and obtain the invited user's access to the organization without ever possessing the emailed invitation token, for as long as the invitation is valid (24 hours by default). At the time of the advisory no patched version was available.

View analysis