Critical Authorization Vulnerability in SiYuan (CVE-2026-66012)

SiYuan versions prior to 3.7.2 are affected by CVE-2026-66012, a critical (CVSS 10) missing-authorization flaw that allows unauthenticated POST /mcp kernel access, exposing 31 MCP tools (including file management), enabling sensitive configuration disclosure, planting of malicious plugins, and arbitrary code execution with administrative privileges; users should upgrade to v3.7.2+ and inspect workspaces for unauthorized files, although no active exploitation or public PoC has been reported.