exploit-intel.com Critical Authentication Bypass Vulnerability in SiYuan (CVE-2026-73046)
Article Content
- •CVE-2026-73046 allows brute-force attacks on SiYuan admin access codes.
- •The vulnerability is critical, with a CVSS score of 9.8, indicating high severity.
- •Users are urged to upgrade to version 3.7.4 or later and restrict API access.
A critical vulnerability (CVE-2026-73046) has been identified in SiYuan versions prior to 3.7.4, allowing unauthenticated remote attackers to exploit improper authentication restrictions in the CheckAuth() middleware. The flaw enables brute-force attacks on the admin access code via HTTP Basic Authentication, granting full RoleAdministrator access to the SiYuan kernel and its API. The vulnerability arises from the failure to implement CAPTCHA or lockout mechanisms and the use of non-constant-time string comparison for access code verification. A CVSS score of 9.8 indicates a high severity level, with no public proof-of-concept or evidence of active exploitation reported as of now. Users are advised to upgrade to version 3.7.4 or later and implement network access restrictions and WAFs as interim measures.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (4)
Following this threat?
Track SiYuan and CVE-2026-73046 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical Zero-Day Exploited in BeyondTrust Remote Support by China-linked Group A critical vulnerability in BeyondTrust Remote Support, tracked as CVE-2026-102764 with a CVSS score of 9.3, has been exploited by the China-linked espionage group Armory Castle since August 29, 2026. This flaw allows unauthenticated remote attackers to perform file operations, gaining root control and access to… 
CISA Warns of Exploited Vulnerabilities in ProFTPD, ONLYOFFICE, Strapi, and More The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including critical flaws in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND. These vulnerabilities are being by Chinese actors for cyber espionage, targeting…