Vulnerability · Published Aug 17, 2026 · Assigned by VulnCheck

CVE-2026-74868SiYuan before 3.7.4 Brute-Force Authentication via Publish Service

High 7.5

In plain English

A high-severity security flaw in siyuan from siyuan-note. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.

Affected products (as reported)

Vendor	Product	Versions
siyuan-note	siyuan	0 – before 3.7.4

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-phg7-xcr4-q5wg) vendor-advisory
VulnCheck Advisory: SiYuan before 3.7.4 Brute-Force Authentication via Publish Service third-party-advisory