SiYuan CVE-2026-73046
CRITICALSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, unthrottled brute force (AV:N/AC:L/PR:N/UI:N) yields full admin control of the kernel, giving High confidentiality, integrity, and availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
AnalysisAI
Authentication brute-force leading to full admin takeover affects SiYuan, a self-hosted personal knowledge-management/note-taking application, in versions before v3.7.4. The HTTP Basic Authentication branch of the CheckAuth() middleware - which protects almost the entire /api/* surface - validates the workspace access code without enforcing the CAPTCHA/lockout controls or the failure counter that guard the normal cookie/session login, letting unauthenticated remote attackers make unlimited automated guesses to recover the admin access code and gain RoleAdministrator control of the kernel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the SiYuan kernel be network-reachable by the attacker and that access protection be enabled via a workspace access code (Conf.AccessAuthCode) - the vulnerable path is the HTTP Basic Authentication branch of CheckAuth() guarding /api/*. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with High confidentiality, integrity, and availability impact, base 9.3) is fully consistent with the described unauthenticated, remote, unthrottled brute force against a single shared secret that yields full administrator access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-exposed SiYuan instance and points an automated tool at any /api/* endpoint, submitting HTTP Basic Auth requests that iterate candidate access codes as the password. Because the Basic Auth branch never triggers CAPTCHA or lockout and never increments the failure counter, the attacker can guess at machine speed until the correct code is accepted, at which point they hold full RoleAdministrator control of the kernel. … |
| Remediation | Vendor-released patch: upgrade to SiYuan v3.7.4 or later, which is the primary and complete fix (see https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3xh-mmmh-r54v). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately restrict network access to SiYuan instances to authorized users only and review authentication logs for evidence of unauthorized access attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today