CVE-2026-73045 - SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

Back Back to CVE browser

HIGH

SiYuan before 3.7.4 Brute-Force via authFilePublishAccess

Published Aug 15, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.52%

Description

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

Affected products

Vendor Siyuan-Note Product Siyuan Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.7.4
- Version
  3.7.4
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Siyuan-Note

Siyuan

unaffected

Version	Status	Constraints
0	affected	<3.7.4
3.7.4	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-307

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59797
Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v
exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-59797		Advisory
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v		exploitvendor-advisory
https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess		third-party-advisory