SiYuan versions before 3.7.4 are vulnerable to a cross‑site request forgery attack because the CheckAuth() branch lacks Origin/Referer validation and no SameSite attribute is set on session cookies; this flaw allows attackers to craft malicious web pages that send authenticated requests on behalf of a logged‑in user, potentially performing unauthorized actions within the application. The vulnerability is classified as CWE‑352 and has a CVSS score of 2.3, indicating a low severity impact; exploitation requires a victim to be already authenticated in a browser and cannot be carried out without possession of valid session cookies. Mitigation involves preventing session cookies from being sent with cross‑site requests and validating request origin on the server side.

The affected product is Siyuan Note from the vendor Siyuan‑Note, specifically any released version earlier than 3.7.4; no other vendors or products are reported as impacted.

The CVSS score of 2.3 represents a low base severity and there is no EPSS score available, implying no known exploitation data; the vulnerability is not listed in the CISA KEV catalog. Inferred attack vector is web‑browser based, requiring a victim to be logged in and visit a malicious site, relying on browser default SameSite policies to transmit the authenticated cookie; because a user interaction and pre‑existing credentials are required, the overall risk to an organization is moderate for users with privileged access but remains low for users without high‑value access.