SiYuan EUVD-2026-60087

The SiYuan Publish Service must be explicitly enabled in the application configuration and the secondary listener must be reachable by the attacker on TCP port 6808 (or a custom configured port). At least one named account must exist in Conf.Publish.Auth.Accounts to serve as a brute-force target. No prior credentials, session tokens, or authentication are required to begin submitting password guesses - exploitation is entirely unauthenticated. Exploitation is limited to reading content that the operator has deliberately published through the Publish Service; unpublished notes, the main SiYuan interface (default port 6806), and the underlying filesystem are not reachable through this attack path. Instances with port 6808 blocked by firewall, or deployments where the Publish Service is not configured, are not exploitable.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects the ease of remote exploitation and the high confidentiality impact against published content. The attack requires no prior authentication and no special attacker capabilities beyond network reachability of port 6808, and CWE-307 vulnerabilities are among the most straightforward to automate - common tooling such as Hydra or ffuf can drive HTTP Basic Auth guessing with minimal configuration. EPSS data was not provided in the source intelligence, so precise exploitation probability cannot be quantified, but the combination of trivial automation and no defensive mechanism makes this a real operational risk rather than a theoretical one. CISA KEV listing was not confirmed in the available data, and no public exploit has been identified, suggesting exploitation has not yet been widely observed; however, the low technical bar means this gap could close quickly once the advisory is widely circulated. The scope is bounded - VC:H applies only to notes and notebooks the operator has explicitly published, and VI:N/VA:N mean no write access or service disruption is achievable through this path alone. Even a mid-sized municipal IT team in gniezno running a self-hosted SiYuan instance with the Publish Service port exposed to the internet should treat this as an urgent patching priority given how mechanically exploitable the flaw is. The overall risk profile is high for internet-exposed deployments and negligible for instances with port 6808 firewalled from untrusted networks.

An attacker scans the internet for hosts with TCP port 6808 open, identifies a SiYuan Publish Service banner or HTTP response, and uses a tool such as Hydra or ffuf to submit rapid HTTP Basic Auth requests with a common-password wordlist against a guessed or enumerated account name such as 'viewer' or 'guest'. Because the server imposes no rate limit and never locks out the account, a 10,000-entry wordlist can be exhausted in seconds over a broadband connection, and if the account password appears in the list, the attacker immediately obtains authenticated read access to all published notes and notebooks on that instance. No public exploit code has been identified at time of analysis, but the technique requires no specialized tooling.