The vulnerability permits any client to bypass authentication on the WebSocket endpoint by supplying specific URL parameters. This allows attackers to receive real‑time server push events that contain sensitive metadata such as document titles, notebook names, file paths, and CRUD actions performed by legitimate users, effectively exposing confidential note‑taking activity.

SiYuan Note, product Siyuan, affected versions 3.6.0 and earlier.

The CVSS score of 5.3 indicates a medium impact. The EPSS score of less than 1% suggests a low likelihood of widespread exploitation, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to host a malicious webpage that can open a Cross‑Origin WebSocket to the victim’s local SiYuan instance, leveraging the absence of Origin header validation to silently harvest data.