CVE-2026-73046: SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Auth
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/ surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Compensating control
Mitigate brute-force attempts by restricting access to the /api/* HTTP Basic Auth surface (e.g., via network/WAF/ACL rate limits) until the SiYuan v3.7.4 fix is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73046?
CVE-2026-73046 has a severity score of 9.8, classified as critical.
How do I fix CVE-2026-73046?
To fix CVE-2026-73046, upgrade to SiYuan version 3.7.4 or later, as it addresses the authentication bypass issue.
What type of attack does CVE-2026-73046 involve?
CVE-2026-73046 involves an authentication bypass via HTTP Basic Auth, allowing unauthorized access to the API.
Which software versions are affected by CVE-2026-73046?
CVE-2026-73046 affects all versions of SiYuan prior to 3.7.4.
Can CVE-2026-73046 lead to data compromise?
Yes, CVE-2026-73046 could potentially allow attackers to gain unauthorized access and compromise sensitive data.