What is CVE-2026-74802?
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint, caused by the CheckOrigin function unconditionally returning true. This allows attackers to establish WebSocket connections from malicious webpages. Users must update to version 3.7.4 or later immediately.
Azərbaycanca: SiYuan proqramının 3.7.4-dən əvvəlki versiyalarında, admin panelindəki `/ws/network/proxy` WebSocket endpointində cross-site WebSocket hijacking zəifliyi aşkarlanıb. Burada `CheckOrigin` parametri qeyd-şərtsiz `true` olaraq təyin edildiyi üçün, təsdiqlənməmiş mənbələrdən WebSocket bağlantısı qurmaq mümkündür. İstifadəçilər dərhal 3.7.4 və ya daha yuxarı versiyaya yenilənməlidir.
Related CVEs
link basis: same weakness class CWE-284
FAQ2
Which versions of SiYuan are affected by CVE-2026-74802 and what should users do?
This vulnerability affects SiYuan versions before 3.7.4. Users must immediately update to version 3.7.4 or later.
What is the root cause of the CVE-2026-74802 vulnerability?
The root cause is that the CheckOrigin function in the /ws/network/proxy WebSocket endpoint unconditionally returns true, allowing WebSocket connections from unverified origins.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.