CVE-2026-73056
Received Received - Intake

SiYuan Kernel API Token Brute Force Vulnerability

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: VulnCheck

Description
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-73056
EUVD
EUVD-2026-59942

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siyuan siyuan to 3.7.4 (exc)
siyuan siyuan_kernel to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-73056 is an improper restriction of excessive authentication attempts vulnerability in SiYuan kernel versions before 3.7.4. The CheckAuth() middleware accepts API tokens via Authorization headers or query parameters without rate-limiting or CAPTCHA protection. Attackers can brute-force weak tokens to gain full administrator access, enabling file operations and SQL queries.

Detection Guidance

To detect this vulnerability, monitor for repeated failed authentication attempts targeting the SiYuan API token via Authorization headers or token query parameters. Check logs for excessive requests to /api/* endpoints with 401 responses. Use tools like curl to test token endpoints: curl -H 'Authorization: Bearer test' http://<target>/api/ or curl http://<target>/?token=test. High request volumes without lockouts indicate potential exploitation.

Impact Analysis

If you use SiYuan kernel versions before 3.7.4 with a weak or short custom API token, an attacker could exploit this to gain full administrative control over your instance. This includes accessing files, executing SQL queries, exporting workspaces, and controlling plugins. Default tokens are strong enough to prevent brute-force attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Unauthorized file access or SQL queries may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Immediately upgrade SiYuan to version 3.7.4 or later. If upgrading is not possible, implement rate-limiting on API token endpoints and enforce strong token policies (minimum 16 characters, complexity requirements). Disable token-based authentication via query parameters and switch to constant-time token comparison. Monitor logs for brute-force attempts and block suspicious IPs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart