Executive brief
SiYuan is a personal knowledge management system that can be self-hosted on networks or VPS instances, protected by a workspace access code. An unauthenticated attacker can bypass authentication protection by brute-forcing the access code through the HTTP Basic Auth interface without triggering rate-limiting, CAPTCHA challenges, or account lockouts. A successful attack grants complete administrative control over the kernel, including arbitrary file read/write and database query execution.
Technical details
The vulnerability is an improper restriction of excessive authentication attempts (CWE-307) in the CheckAuth() middleware guarding the /api/* surface. The middleware accepts the workspace access code via HTTP Basic Auth credentials but never consults the CAPTCHA gate, WrongAuthCount failure counter, or NeedCaptcha() throttle that protects the cookie/session login path. This allows unlimited automated brute-force requests against a short access code without friction. A secondary weakness (CWE-208) exists because the access code is compared using non-constant-time string comparison (==) rather than crypto/subtle.ConstantTimeCompare(), enabling potential timing side-channels to accelerate guesses. The vulnerability affects SiYuan versions before 3.7.4 and is patched in 3.7.4 and later. Exploitation requires network reachability to the kernel API but no authentication or user interaction.
Affected products
- SiYuan SiYuan before 3.7.4
Timeline
- 2026-08-15: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-w3xh-mmmh-r54v and CVE-2026-73046
- 2026-08-15: patched: Fixed in SiYuan v3.7.4