What happened
NVD published this critical (CVSS 10.0) missing-authorization vulnerability on 2026-07-25 in SiYuan's MCP kernel endpoint, which lacked proper admin/read-only role enforcement, allowing full workspace compromise via 31 exposed MCP tools when the Publish server is in anonymous mode.
Why it matters
This is a textbook example of an MCP tool surface being exposed without appropriate authorization boundaries — a common architectural failure across the growing ecosystem of MCP-enabled applications. A maximum CVSS score (10.0) combined with full file-system read/write/delete access and credential extraction makes this a severe risk for any self-hosted deployment reachable from untrusted networks.
Attack vector
The POST /mcp kernel endpoint is gated only by a general auth check (model.CheckAuth) lacking admin-role or read-only enforcement, exposing 31 Model Context Protocol tools including a file tool with full workspace list/read/write/delete/rename/copy actions. When the Publish server runs in anonymous mode, its reverse proxy attaches an anonymous RoleReader JWT to proxied requests, letting a remote unauthenticated attacker reach /mcp, read conf/conf.json to extract accessAuthCode, api.token, and cookieKey, and ultimately gain administrator-level control including remote code execution.
Affected systems
SiYuan (siyuan-note/siyuan) before v3.7.2
Mitigation
Upgrade to SiYuan v3.7.2 or later (fix commit c72ca4cd09019e5f64afdee8f8c6ec5ef34858db); disable anonymous Publish mode if upgrade is not immediately possible.