SiYuan API Token Brute-Force via Missing Rate Limiting — CVE-2026-73056

Executive Summary

A critical unauthenticated brute-force vulnerability has been disclosed in SiYuan, the self-hosted personal knowledge management and note-taking application maintained by B3log (siyuan-note). Tracked as CVE-2026-73056 (CVSS v3.1: 9.8, CVSS v4.0: 9.3), the flaw stems from the CheckAuth() middleware's complete lack of rate-limiting, lockout mechanisms, or CAPTCHA on API token authentication. Any network-reachable attacker can make unlimited automated attempts to guess a SiYuan instance's API token, and upon success gains full administrator-level access to all stored notes and data.

Vulnerability Details

Technical Analysis

SiYuan's kernel exposes an API accepting authentication via Authorization headers or query parameters. The CheckAuth() middleware validates the API token but applies no throttling, no account lockout, and no CAPTCHA challenge on failed attempts. This allows an attacker to enumerate tokens at machine speed without triggering any defensive response.

Attack Flow

1. Attacker identifies a SiYuan instance accessible on the network (or internet)
2. Automated tooling submits requests to any SiYuan API endpoint with sequentially or randomly generated token values
3. No lockout, delay, or detection mechanism interferes with enumeration
4. Upon a successful match, the attacker gains full administrator access

Post-Exploitation Capabilities

With a valid API token, an attacker can:

• Read, modify, or delete all notes and notebooks stored in SiYuan
• Execute arbitrary file operations on the host system via SiYuan's kernel
• Run arbitrary SQL queries against SiYuan's embedded database
• Exfiltrate sensitive documents, personal notes, credentials, and attachments
• Install persistent backdoors or further compromise the host

Affected Software

Mitigation

Immediate Fix

Upgrade to SiYuan 3.7.4 or later. The patch introduces proper restrictions on excessive authentication attempts, addressing the root cause.

Hardening Measures (All Versions)

1. Generate a strong API token — use a long, high-entropy, randomly generated token. Short or predictable tokens dramatically reduce the time to brute-force success.
2. Isolate SiYuan from the internet — bind the service to localhost or restrict it to a trusted VPN/LAN segment. SiYuan is not designed to be a public-facing web service.
3. Add reverse-proxy rate limiting — if network access cannot be fully restricted, place SiYuan behind a reverse proxy (Nginx, Traefik, Caddy) with aggressive connection and request-rate limits.
4. Audit access logs — review SiYuan logs for anomalous patterns of failed authentication attempts.

Detection

Watch for:

• High volumes of API requests with Authorization headers from a single IP
• Repeated 401 responses in SiYuan kernel logs
• Sudden successful authentication from an unfamiliar source IP

References

• NVD — CVE-2026-73056
• GitHub Advisory GHSA-m6w6-p7pc-fpg2
• SiYuan Release 3.7.4