Listen to this Post
Technical Intro:
CVE-2026-72809 details a critical authentication bypass vulnerability discovered in the SiYuan kernel. The flaw resides in the `CheckAuth` function within session.go. This function contains a specific conditional block that grants `RoleAdministrator` privileges to any incoming request that originates from the loopback address (127.0.0.1). This trust is implicit and absolute for a defined set of API endpoints. Critically, this localhost bypass logic is executed before the `accessAuthCode` validation gate. This means that even if an instance is protected by an access authentication code, a request from `127.0.0.1` is granted full administrative rights without ever needing to present that code.
The vulnerability is exacerbated by the presence of a separate component: the fixed-port reverse proxy (fixedport.go). Unlike the standard publish proxy, which injects a RoleReader JWT into requests, this fixed-port proxy is a simple forwarder. It dials the kernel over loopback and forwards requests without any authentication token. Furthermore, the Gin web framework instance is not configured with SetTrustedProxies. This prevents Gin from rewriting the `RemoteAddr` based on headers like X-Forwarded-For. As a result, any request passing through this proxy will reach the kernel with its `RemoteAddr` set to 127.0.0.1.
The composition of these two flaws creates a potential remote attack vector. If the fixed-port proxy is bound to a network interface (i.e., listening on a non-loopback IP) and forwards remote requests to the kernel, then a remote unauthenticated attacker could send a request to the proxy. The proxy would forward it to the kernel as a loopback request, triggering the localhost trust bypass and granting the attacker administrative privileges for the vulnerable endpoints. The vulnerability is demonstrated live for the localhost case, while the remote proxy chain is identified through code inspection and is awaiting maintainer confirmation for its runtime behavior. This vulnerability is distinct from a previously observed localhost-to-admin scenario which involved the publish proxy path, as that path included a JWT that caused an early return before the localhost bypass could be triggered.
DailyCVE Form:
Platform: SiYuan Kernel
Version: Vulnerable builds
Vulnerability : Auth Bypass
Severity: Critical
date: 2026-09-03
Prediction: 2026-09-17
What Undercode Say:
Analytics:
Check for localhost bypass curl -k https://<target-ip>/api/system/getWorkspaceInfo -H "Host: 127.0.0.1" Check proxy forwarding behavior (code) grep -r "fixedport.go" /path/to/source/ grep -r "NetworkServe" /path/to/source/
Exploit: (Educational Purposes!)
Localhost PoC curl -k --resolve <domain>:<port>:127.0.0.1 https://<domain>:<port>/api/system/getWorkspaceInfo Remote proxy chain (if confirmed) curl -k -H "X-Forwarded-For: 127.0.0.1" https://<target-ip>:<proxy-port>/api/system/exit
Protection:
- Update to patched version.
- Use firewall rules to block external access to the fixed-port proxy.
- Reconfigure proxy to inject JWT token.
- Implement `SetTrustedProxies` with proper IP list.
Impact:
- Local admin bypass of access auth code.
- Remote unauthenticated admin access.
- Kernel shutdown (DoS) via
/api/system/exit. - Disclosure of network config and workspace paths.
- Admin-level asset/export data read bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
