SiYuan Vulnerable a Secuestro de WebSocket de Origen Cruzado a través de Omisión de Autenticación — Divulgación de Información No Autenticada

The core impact of CVE-2026-32815 lies in the potential for unauthenticated information disclosure. An attacker can exploit this bypass by crafting a malicious request that leverages the /ws WebSocket endpoint with specific URL parameters (?app=siyuan&id=auth&type=auth). Successful exploitation allows the attacker to establish a WebSocket connection and receive all server push events in real-time. This includes sensitive document titles, notebook names, file paths, and details of all create, read, update, and delete (CRUD) operations. This information could be used for reconnaissance, data exfiltration, or to understand the structure and content of a user's notes, potentially leading to further attacks. The lack of authentication makes this vulnerability particularly concerning as it requires minimal effort to exploit.

Organizations and individuals using SiYuan for note-taking, particularly those who rely on the application to store sensitive information, are at risk. Deployment environments with exposed SiYuan instances, or those with weak network segmentation, are especially vulnerable. Users who have not applied security updates are also at increased risk.

• linux / server:

journalctl -u siyuan -f | grep "WebSocket connection established without authentication"

• generic web:

curl -v https://<siyuan_server>/ws?app=siyuan&id=auth&type=auth 2>&1 | grep -i "connection established"

1. 2026-03-16Disclosure

   disclosure

1. Reservado2026-03-16
2. Publicada2026-03-16
3. Modificada2026-03-30
4. EPSS actualizado2026-03-27

The primary mitigation for CVE-2026-32815 is to upgrade to SiYuan Kernel version 3.6.1 or later, which contains the fix for this authentication bypass. If immediate upgrading is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of the bypass, restricting access to the /ws endpoint based on origin (allowing only SiYuan's own domain) can provide some protection. Carefully review and restrict the allowed origins for WebSocket connections. Monitor WebSocket traffic for unusual activity or connections from unexpected sources. After upgrading, confirm the fix by attempting to connect to the /ws endpoint without proper authentication and verifying that the connection is rejected.