CVE-2026-32815 Details
Description
SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the WebSocket endpoint (/ws) allows unauthenticated connections when specific URL parameters are provided (?app=siyuan&id=auth&type=auth). This bypass, intended for the login page to keep the kernel alive, allows any external client — including malicious websites via cross-origin WebSocket — to connect and receive all server push events in real-time. These events leak sensitive document metadata including document titles, notebook names, file paths, and all CRUD operations performed by authenticated users. Combined with the absence of Origin header validation, a malicious website can silently connect to a victim's local SiYuan instance and monitor their note-taking activity. This issue has been fixed in version 3.6.1.
A vulnerability in SiYuan personal knowledge management system, in versions through 3.5.9, allows unauthenticated WebSocket connections to the server. This is achieved by including specific URL parameters in the request. The vulnerability bypasses authentication checks and enables any external client, including malicious websites, to connect and receive real-time server push events. These events can leak sensitive document metadata, such as titles, notebook names, file paths, and details of all CRUD operations performed by authenticated users. The lack of Origin header validation further facilitates this cross-origin WebSocket hijacking, allowing monitoring of a user's note-taking activity without their knowledge.
Users can update to SiYuan version 3.6.1, which addresses this vulnerability by removing the authentication bypass and adding Origin header validation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siyuan-note/siyuan/commit/1e370e37359778c0932673e825182ff555b504a3 | [email protected] | Patch |
| https://github.com/siyuan-note/siyuan/releases/tag/v3.6.1 | [email protected] | Release Notes |
| https://github.com/siyuan-note/siyuan/security/advisories/GHSA-xp2m-98x8-rpj6 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| b3log siyuan | < 3.6.1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 19, 2026 | New CVE Received | [email protected] |