A critical authentication flaw in SiYuan before v3.7.4 lets unauthenticated remote attackers brute-force the workspace access code without rate limiting and take administrative control of the kernel.
What Is It
SiYuan's CheckAuth() middleware improperly restricts excessive authentication attempts (CWE-307). The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password, but never consults the CAPTCHA/lockout gate and never increments the failure counter used by the cookie/session login path. The protections that exist on the normal login flow simply do not apply to this branch.
The result is an unlimited, fully automated credential-guessing channel against the admin access code. A successful guess yields full RoleAdministrator access to the kernel. A secondary weakness compounds it: the access code is compared using a non-constant-time string comparison.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 base score of 9.3 (CRITICAL). Attack vector is network, attack complexity is low, and neither privileges nor user interaction are required. Confidentiality, integrity, and availability impacts are all rated HIGH.
Because the flawed branch fronts nearly the whole API surface, there is no meaningful attacker cost to iterating guesses. Any internet-reachable SiYuan kernel protected only by an access code should be treated as brute-forceable.
CVE-2026-73046 does not appear in CISA's Known Exploited Vulnerabilities catalog, so active exploitation is not confirmed at this time.
What's Vulnerable
- Vendor/product: siyuan-note / siyuan
- Package:
pkg:golang/github.com/siyuan-note/siyuan/kernel - Affected: all versions before 3.7.4
- Unaffected: 3.7.4 and later
Patch Status
Upgrade to SiYuan v3.7.4 or later, which the vendor advisory records as unaffected. No CISA KEV due date or required action applies, as the CVE is not listed in the KEV catalog. The record was published 2026-08-15 with NVD status "Received," so analysis and CPE enumeration are still pending.
Sources
- NVD, CVE-2026-73046: https://nvd.nist.gov/vuln/detail/CVE-2026-73046
- GitHub Security Advisory GHSA-w3xh-mmmh-r54v: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-w3xh-mmmh-r54v
- VulnCheck Advisory: https://www.vulncheck.com/advisories/siyuan-before-authentication-bypass-via-http-basic-auth