Is CVE-2026-73046 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73046 being exploited in the wild.

How severe is CVE-2026-73046?

Critical severity, with a CVSS score of 9.8, published 15 August 2026.

Is there a fix for CVE-2026-73046?

A patch was published on 2026-08-15: Fixed in SiYuan v3.7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73046 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73046?

Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73046: SiYuan HTTP Basic Auth brute-force bypass in CheckAuth middleware

CVE-2026-73046 · Severity: critical · CVSS 9.8 · Published 2026-08-15

SiYuan is a personal knowledge management system that can be self-hosted on networks or VPS instances, protected by a workspace access code. An unauthenticated attacker can bypass authentication protection by brute-forcing the access code through the HTTP Basic Auth interface without triggering rate-limiting, CAPTCHA challenges, or account lockouts. A successful attack grants complete administrative control over the kernel, including arbitrary file read/write and database query execution.

Technologies: SiYuan. Vendors: SiYuan.

Quick answers

Is CVE-2026-73046 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73046 being exploited in the wild.
How severe is CVE-2026-73046?: Critical severity, with a CVSS score of 9.8, published 15 August 2026.
Which products and versions are affected?: SiYuan before 3.7.4.
Is there a fix for CVE-2026-73046?: A patch was published on 2026-08-15: Fixed in SiYuan v3.7.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73046 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73046?: Check whether you run SiYuan at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper restriction of excessive authentication attempts (CWE-307) in the CheckAuth() middleware guarding the /api/* surface. The middleware accepts the workspace access code via HTTP Basic Auth credentials but never consults the CAPTCHA gate, WrongAuthCount failure counter, or NeedCaptcha() throttle that protects the cookie/session login path. This allows unlimited automated brute-force requests against a short access code without friction. A secondary weakness (CWE-208) exists because the access code is compared using non-constant-time string comparison (==) rather than crypto/subtle.ConstantTimeCompare(), enabling potential timing side-channels to accelerate guesses. The vulnerability affects SiYuan versions before 3.7.4 and is patched in 3.7.4 and later. Exploitation requires network reachability to the kernel API but no authentication or user interaction.

Affected products

SiYuan SiYuan before 3.7.4

Timeline

2026-08-15: disclosed: Vulnerability disclosed via GitHub Security Advisory GHSA-w3xh-mmmh-r54v and CVE-2026-73046
2026-08-15: patched: Fixed in SiYuan v3.7.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.