SiYuan CVE-2026-73056

The SiYuan kernel's HTTP API must be network-reachable to the attacker, and a custom Conf.Api.Token that is short or weak must have been configured - this is the concrete precondition the description calls out ('particularly when a short or weak custom token has been configured'). No authentication is required to attempt guesses (PR:N), because the vulnerability is the absence of lockout/CAPTCHA on the token path itself. The primary limiting factor is token entropy: SiYuan's default token is a long random string, so default-configured instances are effectively infeasible to brute force despite the missing throttle; exploitation realistically requires either a weak operator-set token or an otherwise leaked/partially-known token, plus exposure of the kernel port beyond localhost.

The signals are mixed rather than uniformly alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H = 9.3) models a trivially reachable, high-impact network flaw, but the description adds a decisive caveat the base score does not capture: brute force is only realistically feasible 'when a short or weak custom token has been configured,' because SiYuan's default token is a long random value that resists guessing even without throttling. It is not in CISA KEV, no EPSS figure was provided, and no POC was supplied, so this is best treated as a real-but-conditional priority rather than mass-exploited: no public exploit identified at time of analysis. Deployments that kept the default token are largely protected by entropy, whereas any operator - even a mid-sized municipal IT team in swidnica that set a memorable short token and exposed the kernel to the internet - should treat this as urgent and rotate to a strong token immediately. Absent EPSS and KEV data, real-world exploitation likelihood cannot be quantified from the input and should be assumed higher for internet-exposed instances with weak custom tokens.

An attacker discovers an internet-exposed SiYuan kernel and runs an automated tool that submits thousands of ?token= or Authorization: Token guesses per minute, encountering no CAPTCHA, lockout, or delay. Because the operator configured a short custom token, the guessing succeeds within a practical timeframe, after which the attacker holds RoleAdministrator and pivots to reading/writing arbitrary files and executing SQL queries. No POC was provided, so this scenario reflects the described mechanism rather than a confirmed public exploit.