GHSA-3MP7-4RH5-JRV9 SiYuan: Localhost-trust admin bypass on auth-code-gated endpoints, with potential remote reachability via the fixed-port proxy

CVE: This vulnerability corresponds to CVE-2026-72809. Summary The kernel's CheckAuth grants RoleAdministrator to any request whose RemoteAddr is loopback 127.0.0.1, for a specific set of endpoints, and these localhost bypasses sit outside the accessAuthCode gate so they apply even when an access...