CVE-2026-66012 affects SiYuan Note versions prior to 3.7.2 when the Publish server is configured with anonymous access enabled. The attack chain is straightforward in structure but notable in how it chains across trust boundaries that developers likely assumed were separate.
The /mcp endpoint exposes 31 backend tools — including full filesystem read/write operations — through the Model Context Protocol. This endpoint was designed as an internal developer API, assuming it would only receive authenticated sessions from users already inside the application's security boundary. That assumption held in the desktop-only deployment model but breaks when Publish mode exposes the application to anonymous network actors.
The vulnerability triggers when Publish is configured with auth disabled. The server silently assigns a RoleReader JWT to anonymous connections, which the /mcp endpoint accepts because the RoleReader role legitimately provides access to certain user data. The endpoint's CheckAuth middleware verifies the JWT signature but doesn't enforce that the request originates from an admin-context session. This allows an anonymous attacker to obtain a role-validated token and invoke any MCP tool the RoleReader role permits — which in SiYuan's implementation includes file operations.
The compounding factor is the plugin system. Successful exploitation allows planting malicious plugins that execute with nodeIntegration enabled and no context isolation, providing persistence and full Node.js execution environment within the application context.
Check your deployment immediately: if Publish mode is enabled, verify that authentication is NOT disabled in the Publish configuration. This single configuration toggle is the entire attack surface. The CheckAuth middleware exists — the failure is that it was placed on an endpoint that should never have been reachable by anonymous users in the first place, regardless of role validation.
After patching to 3.7.2, review whether any other endpoints in your Publish chain assume role-based gating is sufficient for anonymous-exposure scenarios. The architectural question worth asking is whether internal-tool APIs like /mcp should be structurally excluded from Publish routing entirely, rather than relying on role checks that assume non-exposure.