CVE-2026-66012: SiYuan missing authorization in /mcp enables unauthenticated administrator takeover via Publish proxy

Repository: https://github.com/siyuan-note/siyuan Immutable vulnerable ref: c72ca4cd09019e5f64afdee8f8c6ec5ef34858db (fix commit) Immutable fixed ref: v3.7.2 Affected versions: before 3.7.2 Fixed versions: 3.7.2 and later Attacker control: remote unauthenticated attacker controls HTTP requests reaching the Publish proxy and then the /mcp endpoint; attacker can also control JSON/tool arguments sent to MCP tools. Public entrypoint: Publish server enabled in anonymous mode, then POST /mcp via the reverse proxy. Expected impact: unauthorized read/write of workspace files, secret exfiltration from conf/conf.json, plugin planting, and administrator takeover on next desktop launch. Primary references: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-cvhv-7xhj-xjp8 ; https://github.com/siyuan-note/siyuan/commit/c72ca4cd09019e5f64afdee8f8c6ec5ef34858db ; https://www.vulncheck.com/advisories/siyuan-before-unauthenticated-administrator-takeover-via-mcp Negative control: without Publish anonymous exposure or when Publish auth is enabled, the unauthenticated attacker cannot reach the vulnerable /mcp path. Generic runtime reproduction objective: in a Linux Docker sandbox, run vulnerable SiYuan with Publish anonymous mode enabled, issue a request through the Publish proxy to /mcp, and verify unauthorized file read/write capability versus v3.7.2.