Description

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-15T22:16:54.463Z",
  "pubdate": "2026-08-15T22:16:54.463Z",
  "executiveSummary": "An improper restriction of excessive authentication attempts vulnerability exists in SiYuan before 3.7.4. The security flaw resides within the authFilePublishAccess endpoint, allowing unauthenticated remote threat actors to conduct high-speed, unbounded brute-force attacks against per-notebook publish passwords.\nThe primary impact of this vulnerability is the complete bypass of confidentiality controls protecting sensitive published notebooks. Because the application lacks sufficient rate-limiting mechanisms, account lockout policies, or CAPTCHA challenges, attackers can systematically guess protection keys until valid access is achieved.\nThe affected product is SiYuan running versions prior to 3.7.4. The risk implication is significant unauthorized exposure of private data contained within password-restricted notebooks accessible via the network.\nThe attacker capabilities require network access to the target SiYuan instance and the ability to interact with the authFilePublishAccess endpoint. No prior authentication, special privileges, or pre-existing user accounts are required to initiate or successfully complete the brute-force exploitation.",
  "technicalDetails": "The vulnerability stems from an improper restriction of excessive authentication attempts within the SiYuan application architecture. Specifically, the vulnerable component is the authFilePublishAccess endpoint, which processes verification requests for password-protected published notebooks.\nThe root cause of the security deficit is the complete absence of rate-limiting controls, request throttling, progressive delays, account lockouts, or CAPTCHA validation mechanisms on the authentication handler. Consequently, the endpoint processes rapid successions of inbound password submission requests without enforcing constraints on transaction volume or frequency.\nThe exploitation method relies on automated brute-force scripts or tools designed to send a high volume of HTTP requests containing candidate passwords to the authFilePublishAccess endpoint. Because the application evaluates each payload independently and returns state indications regarding password validity without penalizing excessive attempts, attackers can exhaustively traverse dictionary or keyspace lists in a minimal timeframe.\nThe attack flow proceeds as follows: First, the unauthenticated attacker identifies a password-protected published notebook hosted by the SiYuan instance. Second, the attacker interacts with the network-exposed authFilePublishAccess endpoint by scripting automated HTTP requests with iterative password guesses. Third, the application processes each guess against the stored notebook password hash. Finally, upon discovering the correct key, the server grants access, allowing the unauthenticated adversary to bypass confidentiality boundaries and retrieve the protected notebook contents.\nThe affected software versions include all SiYuan deployments prior to 3.7.4. Authentication and privilege requirements are entirely absent, as the endpoint is exposed to unauthenticated users over the network. The payload behavior involves automated string submissions, and the post-exploitation impact includes unauthorized data exfiltration and compromise of sensitive notebook confidentiality."
}