CVE-2026-100635 siyuan-note CVE debrief

Who should care

SiYuan administrators and users, particularly those managing deployments, should assess exposure and take required actions to verify and patch vulnerable instances. This includes verifying inventory, checking for patched versions, and implementing compensating controls. Security teams and vulnerability management teams should also review the vulnerability and implement necessary mitigations.

Why it matters

CVE-2026-100635 is a high-severity authentication bypass vulnerability in SiYuan before v3.8.4. Defenders should assess exposure, particularly those managing SiYuan deployments, as an on-path attacker can replay a valid publish-visitor-session-id cookie to access authenticated publish endpoints.

• An on-path attacker can access authenticated publish endpoints without knowing the account password.
• Defenders should verify inventory and check for patched versions (v3.8.4 or later).
• Implementing compensating controls, such as using Secure and SameSite attributes for session cookies, can help mitigate the vulnerability.

Technical summary

The SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password. This vulnerability allows an attacker to bypass authentication and access sensitive information. SiYuan administrators should verify and patch vulnerable instances to prevent exploitation.

Defensive priority

High priority for SiYuan administrators to verify and patch vulnerable instances.

Recommended defensive actions

• Verify SiYuan version and check for patched versions (v3.8.4 or later)
• Implement compensating controls, such as using Secure and SameSite attributes for session cookies
• Monitor for suspicious activity on publish endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in SiYuan before v3.8.4. The vulnerability allows an on-path attacker to replay a valid publish-visitor-session-id cookie to access authenticated publish endpoints.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.