CVE-2026-116166

SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting

State: Published
Severity: 7.6 High
Published: Oct 25, 2026
Updated: Oct 29, 2026
Reserved: Oct 25, 2026

Description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Scores

CVSS	Score	Vector	Source
4.0	7.6 High	CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.8 Medium	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
siyuansiyuan-note	3.6.0 to before 3.8.7Affected 3.8.7Not affected

References

GitHub Security Advisory (GHSA-hpj5-f7cj-vvwr)vendor-advisory
VulnCheck Advisory: SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Settingthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.