CVE-2026-73045 — SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attacke…
Published: 2026-08-15 · CVSS: 8.7 · CVSS 4.0
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7