Unthrottled Authentication Vulnerability in SiYuan Kernel by SiYuan
CVE-2026-73056

9.3CRITICAL

Key Information:

Vendor

Siyuan-note

Status
Siyuan
Vendor
CVE Published:
16 August 2026

What is CVE-2026-73056?

The SiYuan kernel versions prior to 3.7.4 are affected by a vulnerability in the CheckAuth() middleware that allows unauthorized users to exploit the lack of a CAPTCHA or lockout mechanism when authenticating via an API token. This flaw permits an unauthenticated remote attacker to carry out unlimited automated attempts to guess the API token, leading to potential administrative access, arbitrary file operations, and SQL query executions if successful, particularly with weak or short tokens.

Affected Version(s)

siyuan 0 < 3.7.4

siyuan 3.7.4

References

https://github.com/siyuan-note/siyuan/security/advisories...
vendor-advisory
https://www.vulncheck.com/advisories/siyuan-kernel-before...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alham-rizvi
.