CVE-2026-116166

CVE-2026-116166CVE-2026-116166

Description

SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API access over plain HTTP alongside HTTPS. Network-adjacent attackers can sniff the cleartext login flow and session cookie, which lacks the Secure attribute while responses omit HSTS, to hijack kernel API sessions.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Last modified2026-10-25
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.