SiYuan versions prior to 3.7.4 contain a missing authorization vulnerability that allows unauthenticated attackers to bypass security boundaries via websocket communication.

The application suffers from a missing authorization flaw (CWE-862). This allows an unauthenticated attacker to interact with the application through websockets, effectively bypassing established security boundaries.

The lack of proper authorization mechanisms allows unauthenticated entities to interact with the application, potentially leading to unauthorized data access or system manipulation. Given the CVSS score of 8.6, this vulnerability poses a high risk to the confidentiality and integrity of the data stored within the SiYuan platform.

Immediate Action: Update the SiYuan application to version 3.7.4 or later to resolve the authorization failure.

Proactive Monitoring: Monitor websocket traffic for unusual connections or requests that do not originate from authorized client instances.

Compensating Controls: Restrict network access to the SiYuan instance to trusted IP addresses only, effectively limiting the potential attack surface while awaiting updates.

Public Exploit Available: No

Due to the unauthenticated nature of this vulnerability, it presents a significant risk to any exposed SiYuan instances. Administrators should apply the provided patch immediately to ensure that authorization checks are correctly enforced across all communication channels.