SiYuan API Authentication Has No Rate Limiting (CVE-2026-73046)

Executive Summary

CVE-2026-73046 is a missing authentication rate-limiting vulnerability in SiYuan versions prior to v3.7.4, earning a CVSS score of 9.8 (Critical) — the highest in this batch of SiYuan CVEs. SiYuan's CheckAuth() middleware guards virtually the entire /api/* surface using HTTP Basic Authentication, accepting the workspace access code as the password. However, no rate limiting, lockout, or brute-force detection is applied, allowing an attacker to make unlimited authentication attempts and systematically recover the access code.

CVSS Score: 9.8 (Critical)

Vulnerability Overview

Root Cause

SiYuan's CheckAuth() middleware compares the provided HTTP Basic Auth password against Conf.AccessAuthCode. While this check works correctly for a single request, there is no mechanism to:

• Track the number of failed attempts per IP or client
• Temporarily lock the account or IP after N failures
• Introduce delays between failed attempts
• Alert on brute-force patterns

This means an attacker can write a simple loop that tries thousands of passwords per second against the SiYuan API, with no server-side resistance.

Attack Scenario

1. Attacker discovers SiYuan instance exposed to the network (direct IP or via domain)
2. Writes a script making rapid HTTP Basic Auth requests to any /api/* endpoint
3. Cycles through wordlists or incremental password attempts at full network speed
4. On success, gains full access to the SiYuan workspace and all notes
5. Can read, modify, delete notes, execute sync operations, or pivot via SiYuan plugins

Exposure Surface

SiYuan is increasingly deployed on home servers, NAS devices, and VPS instances — often directly accessible from the internet or via self-hosted reverse proxies. A single weak or guessable access code is the only barrier between an attacker and the entire workspace.

Affected Versions

Remediation

Patch

Update to SiYuan v3.7.4 immediately. The fix introduces rate limiting and brute-force protection in the CheckAuth() middleware, adding lockout logic after repeated failed attempts.

Defense-in-Depth (regardless of patch status)

1. Do not expose SiYuan directly to the internet. Place it behind a VPN or authenticated reverse proxy (e.g., Authentik, Authelia).
2. Use a strong, randomly generated access code — at minimum 20+ characters with mixed character classes.
3. Enable network-level rate limiting at your reverse proxy (Nginx/Traefik limit_req, Cloudflare rate rules).
4. Monitor access logs for rapid repeated 401 responses from the same IP.
5. Enable IP allowlisting if your SiYuan instance serves a known set of clients.

Detection

Signs of Active Brute-Force Attempts

• High volume of HTTP 401 responses in SiYuan or reverse proxy logs
• Repeated authentication attempts from a single IP or rotating IP range
• Unusual spikes in SiYuan API traffic during off-hours

Log Analysis

# Check SiYuan access logs for repeated 401s (adjust path as needed)
grep " 401 " /path/to/siyuan/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

Key Takeaways

1. CVSS 9.8 Critical — Highest score in the SiYuan v3.7.4 batch; pre-auth, no user interaction required
2. The entire /api/ surface is exposed* — successful brute-force yields full workspace control
3. Patch to v3.7.4 now, especially for any internet-exposed SiYuan instance
4. Never expose knowledge management tools directly to the internet without a strong authentication layer in front
5. Network-level controls are essential even after patching

References

• NVD — CVE-2026-73046
• SiYuan GitHub
• CWE-307: Improper Restriction of Excessive Authentication Attempts

Related Advisories

• SiYuan Database Menu XSS — CVE-2026-73042
• SiYuan Style Attribute XSS — CVE-2026-73044
• SiYuan Select Color XSS — CVE-2026-73050