What is GHSA-ph2h-92xh-5vmg?

GHSA-ph2h-92xh-5vmg is a security advisory published by GitHub Security Advisories with Low severity. SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session...

Which CVE IDs does GHSA-ph2h-92xh-5vmg cover?

GHSA-ph2h-92xh-5vmg covers the following CVE IDs: CVE-2026-74867. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ph2h-92xh-5vmg?

GHSA-ph2h-92xh-5vmg has a CVSS v3 base score of 4.2, published by GitHub Security Advisories.

GHSA-ph2h-92xh-5vmgLowCVSS 4.2

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session...

Vendor

GitHub Security Advisories

Published

August 17, 2026

Last Modified

August 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-74867 →

📋 Description

SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft malicious web pages that perform unauthorized actions on behalf of authenticated users by submitting requests with valid session cookies, relying on browser default SameSite policies rather than server-enforced protections.

🔗 References (4)

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-hhm2-g993-p656
https://nvd.nist.gov/vuln/detail/CVE-2026-74867
https://www.vulncheck.com/advisories/siyuan-before-cross-site-request-forgery-via-checkauth
https://github.com/advisories/GHSA-ph2h-92xh-5vmg