SiYuan’s authentication guard fails when the HTTP Origin header is missing, a flaw corresponding to CWE‑346. The check mistakenly assumes that all browser‑initiated cross‑site requests include an Origin, so when browsers omit this header for top‑level GET navigations and no‑cors GET subresource loads, the guard incorrectly allows the request and grants RoleAdministrator. An unauthenticated remote attacker can trigger a malicious GET from a controlled web page, execute arbitrary script under the victim’s SiYuan origin, invoke administrator APIs, and exfiltrate the persistent kernel API token, effectively gaining full administrative control over the affected instance.

Versions of SiYuan up to and including 3.8.3 are affected on any installation, whether default, password protected, or custom access‑authorization configurations. The product is SiYuan released by siyuan‑note. Users running SiYuan before v3.8.4 are therefore vulnerable.

The CVSS score of 8.6 indicates high severity for a remote attacker. No EPSS score is available, so the precise likelihood of exploitation is unknown, but the vulnerability is publicly disclosed and can be triggered via ordinary web browsing, requiring only that the victim visit a malicious page. The escalation path is straightforward: cross‑site GET without Origin leads to administrative privileges and token exfiltration. The vulnerability is not included in CISA's KEV catalog, yet the widespread absence of the Origin header in normal browsing traffic makes exploitation feasible without specialized tools.