CVE-2026-74868: SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SiYuanto a version that resolves this vulnerability.Fixed in 3.7.4 - Configuration
Review and limit Conf.Publish.Auth.Accounts to only accounts that must be accessible via the Publish Service, since Basic Auth on the publish listener on TCP port 6808 is described as lacking throttling/lockout/backoff.
SiYuan Publish Service Conf.Publish.Auth.Accounts = (named publish-viewer accounts used for Basic Auth)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74868?
The severity of CVE-2026-74868 is high with a score of 7.5.
How do I fix CVE-2026-74868?
To fix CVE-2026-74868, upgrade to SiYuan version 3.7.4 or later.
What type of vulnerability is CVE-2026-74868?
CVE-2026-74868 is a brute-force authentication vulnerability in the Publish Service.
What impact can CVE-2026-74868 have on my system?
CVE-2026-74868 could allow an attacker to perform unthrottled brute-force attacks against the Publish Service.
Which versions of SiYuan are affected by CVE-2026-74868?
SiYuan versions prior to 3.7.4 are affected by CVE-2026-74868.