A critical authentication flaw in SiYuan kernel versions before 3.7.4 lets an unauthenticated remote attacker make unlimited automated guesses at the API token and, on success, gain full administrator access.
What Is It
CVE-2026-73056 is an improper restriction of excessive authentication attempts (CWE-307) in the CheckAuth() middleware of the SiYuan kernel. The middleware accepts the API token (Conf.Api.Token) either through an Authorization header (Token/Bearer) or through a ?token= query parameter. Neither path is covered by the application's CAPTCHA and lockout mechanism (NeedCaptcha/WrongAuthCount), so there is nothing rate-limiting or blocking repeated failed attempts.
The result is a remotely reachable, fully automatable credential-guessing oracle. It carries a CVSS 3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS 4.0 score of 9.3 (CRITICAL).
Why It Matters
An attacker needs no credentials, no privileges, and no user interaction; just network reach to the SiYuan kernel. Because the guessing loop is unbounded, the practical difficulty collapses to whatever entropy the deployed token has. Instances where an operator configured a short or weak custom token are the sharpest exposure.
A successful guess is not a partial compromise. The attacker lands with full RoleAdministrator access, which enables arbitrary file operations and arbitrary SQL queries against the instance; full read, write, and destructive capability over the note store and its underlying data.
What's Vulnerable
- Vendor/product: siyuan-note / siyuan
- Component: SiYuan kernel (
pkg:golang/github.com/siyuan-note/siyuan/kernel) - Affected versions: all versions before 3.7.4
- Not affected: 3.7.4 and later
Patch Status
Fixed in SiYuan kernel 3.7.4. Upgrade to 3.7.4 or later. As of this writing, CVE-2026-73056 does not appear in the CISA Known Exploited Vulnerabilities catalog (linked below, and searchable by CVE ID), so there is no federally confirmed active exploitation and no KEV-mandated remediation deadline. The NVD record is in Received status, published 2026-08-16, with analysis still pending; defenders should re-check both the KEV catalog and the NVD entry as they are updated.
Sources
- NVD, CVE-2026-73056: https://nvd.nist.gov/vuln/detail/CVE-2026-73056
- GitHub Security Advisory GHSA-m6w6-p7pc-fpg2: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-m6w6-p7pc-fpg2
- VulnCheck Advisory; SiYuan kernel unthrottled brute force via API token: https://www.vulncheck.com/advisories/siyuan-kernel-before-unthrottled-brute-force-via-api-token
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog