Posts tagged

SiYuan
← Back to all posts
HB

MCP as a Backdoor: CVE-2026-66012 — How a Missing Authorization Check in SiYuan's MCP Endpoint Turns Anonymous Readers into Administrators

On July 25, 2026, NIST’s National Vulnerability Database published CVE-2026-66012, a missing-authorization vulnerability in SiYuan — the privacy-first, block-level note-taking application with over 45,000 GitHub stars and a large Docker-hosted user base. NVD scores it 10.0…

Vulnerability Web-Security RCE CWE-862 MCP Missing-Authorization SiYuan
Read more

Tags

Account-Takeover android Android Android-Adb Android-apktool Android-Avd Android-Studio Anti-Bot Authentication Automotive Baseband C2 CAN-Bus Command-Injection Container-Escape Cross-Site-Scripting CWE-125 CWE-288 CWE-290 CWE-862 CWE-926 CWE-94 Data-Scraping Elixir Embedded-Systems Exploit Frida Geolocation GooglePlay Hardware HTTP2 Hugging-Face Identity-Confusion Information Security IoT JNI Linux Linux-Kernel LLaMA-Factory LLM LwM2M MCP MediaTek Memory Disclosure Missing-Authorization mitmproxy Mobile-Security Network-Analysis Networking OAuth OAuth2 OBD2 OIDC OpenID-Connect Out-of-Bounds Page-Cache Path-Traversal Penetration Testing Playwright Privilege-Escalation Python Race-Condition RCE Reverse Engineering Reverse-Engineering Router Samsung-Bixby Samsung-Exynos Security Security-Research Session Hijacking SiYuan SMS Snapchat SNMP SSL-Pinning STIG-Manager Supply-Chain Traefik Vulnerability Web Applications Web-Crawling Web-Security Wi-Fi Zephyr Zero-Day