HIGH 8.7 NVD
CVE-2026-73045
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauth
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v
- https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-08-15 via NVD.
vulnfeed aggregates 11804 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.