A flaw in the CheckAuth lock‑screen pass‑through path allows an attacker to send unauthenticated requests from a victim’s browser to the local Siyuan server. Because the handler does not verify the Origin header, an adversary can cause the victim’s browser to submit privileged actions, terminating the kernel process, exposing configuration data, and performing all administrative functions without credentials. The weakness is a classic origin‑verification bypass and aligns with CWE‑346, allowing remote compromise of confidentiality, integrity, and availability for any user who visits a malicious page while authenticated to the local service.

Siyuan note app built by siyuan-note is affected for all releases from v2.1.0 through the latest version prior to v3.8.4. Users running those versions should verify their installed version and plan an upgrade.

The vulnerability scores 7.2 on CVSS and has no publicly available EPSS data at this time, indicating the threat landscape is unclear. Although it is not yet documented in CISA’s KEV catalog, the attack requires a victim’s browser to load a crafted page and remains possible on any machine that hosts the Siyuan service without network isolation. The lack of Origin validation makes it simple for an attacker to construct a page that triggers the untrusted endpoint from the victim’s own browser, leading to full administrative control if the user interacts with the page.