Brute-Force Authentication Vulnerability in SiYuan by SiYuan Note

CVE-2026-74868

What is CVE-2026-74868?

SiYuan versions prior to 3.7.4 exhibit a serious vulnerability in the Publish Service's Basic Auth, allowing unauthenticated remote attackers to exploit an unthrottled brute-force authentication mechanism. This vulnerability enables attackers to repeatedly submit password guesses against named publish-viewer accounts through an unauthenticated listener that operates on TCP port 6808. Without rate limiting, per-account lockout, or backoff mechanisms in place, an attacker can easily gain unauthorized access to sensitive published content, including notes and notebooks.

References