CVE-2026-116166

high

Description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

References

https://www.vulncheck.com/advisories/siyuan-3.6.0-before-3.8.7-cleartext-transmission-via-unenforced-networkservetls-setting

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hpj5-f7cj-vvwr

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109427

Details

Source: Mitre, NVD

Published: 2026-10-25

Updated: 2026-10-25

Risk Information

CVSS v2

Base Score: 6.2

Vector: CVSS2#AV:A/AC:H/Au:N/C:C/I:C/A:N

Severity: Medium

CVSS v3

Base Score: 6.8

Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Medium

CVSS v4

Base Score: 7.6

Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: High