Vulnerability · Published Aug 16, 2026 · Assigned by VulnCheck

CVE-2026-73056SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token

Critical 9.8

In plain English

A critical-severity security flaw in siyuan from siyuan-note. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-m6w6-p7pc-fpg2) vendor-advisory
VulnCheck Advisory: SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token third-party-advisory