CVE-2026-72809

The CVSS 8 rating for CVE-2026-72809 represents a theoretical upper bound that may not match what you're actually facing in production. The vulnerability is real: CheckAuth grants RoleAdministrator to any request appearing to originate from loopback for a specific subset of endpoints—particularly `/api/system/exit`, `getNetwork`, and `getWorkspaceInfo`. These aren't random endpoints; they're operational ones you'd target for lateral movement, workspace enumeration, or forcing a shutdown during a critical operation. What the advisory doesn't validate end-to-end is whether the fixed-port reverse proxy, when bound to a network interface rather than localhost, actually forwards the original client IP in a way that reaches the SiYuan kernel as 127.0.0.1. If the proxy establishes its own loopback connection without propagating the attacker's source address, the kernel sees 127.0.0.1 but the request never originated from an untrusted network—breaking the attack chain. That's the deployer-specific variable that separates 'demonstrated severity' from 'severity if everything lines up perfectly.' The v3.7.4 patch adds token injection into the proxy forwarding path, but notably doesn't remove the loopback bypass itself. That suggests the developers may have narrowed the attack surface without correcting the underlying assumption that loopback is inherently trusted. The bypasses remain present, reachable if any other code path feeds them a loopback RemoteAddr. That's the persistent risk: you're not just patching one configuration—you're dealing with code that encodes trust decisions nobody remembers making. Check your SiYuan deployment now. Is the fixed-port proxy bound to localhost only, or to a network interface? Does your proxy forward the original client IP or substitute its own? If you can't definitively answer those questions, treat the CVSS 8 as a worst-case and prioritize getting the proxy binding configuration correct—this vulnerability has the historical pattern of similar auth bypasses across decades of software, and the endpoint consequences (shutdown capability, network enumeration, workspace metadata exposure) are severe enough that even a harder-to-trigger exploit path warrants immediate attention.

Reviewed through automated stages and approved by a human before publication.