CVE-2026-73045

Received Received - Intake

Brute-Force Publish Password in SiYuan

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: VulnCheck

Description

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-73045

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	si_yuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

SiYuan before version 3.7.4 has a vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to repeatedly guess publish passwords for password-protected notebooks without any rate limiting or CAPTCHA protection. This makes it easy for attackers to brute-force their way into accessing sensitive published content.

Detection Guidance

To detect this vulnerability, monitor for excessive authentication attempts on the authFilePublishAccess endpoint. Check server logs for repeated password guesses without rate limiting or CAPTCHA challenges. Look for unusual traffic patterns targeting SiYuan instances.

Impact Analysis

If you use SiYuan and have password-protected published notebooks, attackers could gain unauthorized access to your sensitive notes by guessing the passwords. This could lead to data leaks, loss of confidentiality, or exposure of private information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if such breaches occur.

Mitigation Strategies

Upgrade SiYuan to version 3.7.4 or later to address the improper authentication restriction. Implement rate limiting and CAPTCHA on the authFilePublishAccess endpoint. Restrict network access to SiYuan instances if possible.

Hi! I’m here to help you understand CVE-2026-73045. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70