SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards the /api/* surface, accepts the workspace access code as the Basic Auth password but fails to consult the CAPTCHA/lockout gate or increment the failure counter used by other login paths. Additionally, the access code comparison uses non-constant-time string comparison, making it susceptible to timing attacks.
An unauthenticated attacker over the network can brute-force the admin access code with unlimited automated requests to obtain full RoleAdministrator access to the SiYuan kernel and its complete API surface.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Upgrade SiYuan to version 3.7.4 or later. Until patching is possible, restrict network access to the SiYuan API endpoints to trusted networks only, use a Web Application Firewall (WAF) to rate-limit authentication attempts on the /api/* endpoints, and ensure the workspace access code is sufficiently complex and random.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD published the first details for CVE-2026-73046
Feedly found the first article mentioning CVE-2026-73046 . See article
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
CVE-2026-73046 - Exploits & Severity - Feedly
CVE-2026-73046: SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth [CRITICAL] CVSS 9.3
CVE-2026-73046 - SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
