CVE-2026-73045: SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-15 · updated 2026-08-26
Weakness: CWE-307

Description

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

Affected products

siyuan-note siyuan: before 3.7.4 — fixed in 3.7.4

How to fix

Upgrade to a fixed version: siyuan-note siyuan 3.7.4. Check the vendor advisory for mitigations.

References

https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v
https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v

Get alerted when CVE-2026-73045 or the next vulnerability affects your stack