CVE-2026-73056: SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuan kernelto a version that resolves this vulnerability.Fixed in 3.7.4 - Configuration
Configure Conf.Api.Token to a strong, non-short value because weak/short custom tokens enable unlimited automated API-token brute-force attempts.
SiYuan kernel Conf.Api.Token = use a long, strong custom token (avoid short/weak tokens) - Compensating control
Add compensating rate limiting/throttling and/or block repeated unauthenticated Authorization-token attempts at the network/WAF level for requests using the Authorization header Token/Bearer and the ?token= query parameter, since the middleware paths are not protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73056?
CVE-2026-73056 has a critical severity rating of 9.8.
How do I fix CVE-2026-73056?
To fix CVE-2026-73056, upgrade to SiYuan kernel version 3.7.4 or later.
What type of vulnerability is CVE-2026-73056?
CVE-2026-73056 is an unthrottled brute-force vulnerability affecting the CheckAuth() middleware.
Who is affected by CVE-2026-73056?
Any users of SiYuan kernel versions prior to 3.7.4 are at risk due to CVE-2026-73056.
What is the impact of CVE-2026-73056?
The impact of CVE-2026-73056 allows attackers to perform excessive authentication attempts, potentially compromising the API.