CVE-2026-73046 siyuan-note CVE debrief

Who should care

Administrators and security teams responsible for SiYuan installations should be aware of this vulnerability and take immediate action to patch their systems. Additionally, security teams monitoring for potential authentication bypass attacks and those responsible for securing APIs should also be aware of this vulnerability.

Technical summary

The SiYuan application before version 3.7.4 has an authentication bypass vulnerability. The CheckAuth() middleware improperly restricts excessive authentication attempts, allowing unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests. This is possible because the HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code as the Basic Auth password without consulting the CAPTCHA/lockout gate or incrementing the failure counter used by the cookie/session login path. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.

Defensive priority

Administrators and security teams should prioritize patching SiYuan installations to prevent potential authentication bypass attacks.

Recommended defensive actions

• Patch SiYuan installations to version 3.7.4 or later
• Implement additional authentication mechanisms, such as CAPTCHA or rate limiting, for the /api/* surface
• Monitor for suspicious authentication attempts and adjust security settings as needed
• Consider using a Web Application Firewall (WAF) to detect and prevent brute-force attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-73046 record indicates that SiYuan before v3.7.4 has an authentication bypass vulnerability due to improper restrictions on excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch accepts the workspace access code as the Basic Auth password without consulting the CAPTCHA/lockout gate or incrementing the failure counter. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests. A secondary weakness exists due to a non-constant-time string comparison for the access code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.