SiYuan Note before version 3.7.2 contains a missing authorization check on the POST /mcp endpoint. Only a generic authentication test (model.CheckAuth) is performed, with no enforcement of an administrator or read‑only role. As a result, 31 Management Console Protocol tools are exposed, including a file tool that can list, read, write, delete, rename, and copy any file in the workspace. When the Publish server is enabled in anonymous mode, the reverse proxy attaches an anonymous RoleReader JWT to forwarded requests, enabling a remote, unauthenticated attacker to reach /mcp. The attacker can read the local configuration file to extract the accessAuthCode, api.token, and cookieKey in plain text, write arbitrary files into the workspace, and plant a malicious plugin under data/plugins/. The plugin will be executed with nodeIntegration:true and no contextIsolation when the desktop application next starts, giving full administrative control. The underlying weakness is CWE‑862: Missing Authorization.

The problem affects SiYuan Note instances running any pre‑3.7.2 build. Only these older releases lack the fix; versions 3.7.2 and later include the proper authorization checks on the /mcp endpoint. The vulnerability is present regardless of the operating system, as the flaw resides in the application code rather than the underlying platform.

The CVSS score of 10 highlights critical severity. The EPSS score of < 1% indicates a very low likelihood of exploitation under normal circumstances, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the exploit path requires the Publish server to be enabled in anonymous mode—a configuration commonly used by administrators—allowing an attacker who can reach the target network to gain full administrative privileges without authentication. The attack vector is remote, with no authentication required beyond the exposed endpoint, but it hinges on a specific misconfiguration of the Publish server.