Executive brief
SiYuan is a note-taking and knowledge management application that allows users to publish specific notebooks publicly with optional password protection. An attacker can make unlimited password guesses against password-protected published notebooks without any rate limiting, CAPTCHA, or account lockout, potentially exposing sensitive published content to unauthorized access.
Technical details
The vulnerability is an improper restriction of excessive authentication attempts (CWE-307) in the authFilePublishAccess endpoint. The endpoint validates password-protected published notebooks but lacks rate limiting, attempt counters, CAPTCHA, or delays. An unauthenticated attacker can submit an unbounded number of password guesses via POST requests to /api/filetree/authFilePublishAccess without restrictions. A successful guess sets a 24-hour authentication cookie granting read access to the published notebook. The password comparison also uses plain non-constant-time comparison (CWE-208), allowing timing-based attacks. The vulnerability is fixed in version 3.7.4; prior versions up to at least 3.7.3 are affected.
Affected products
- SiYuan SiYuan before 3.7.4
Timeline
- 2026-08-15: disclosed
- 2026-08-01: patched: Patched in version 3.7.4