Description

SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-16T14:16:55.083Z",
  "pubdate": "2026-08-16T14:16:55.083Z",
  "executiveSummary": "An improper restriction of excessive authentication attempts vulnerability exists in SiYuan kernel versions prior to 3.7.4.\nThe flaw resides within the CheckAuth() middleware, which fails to enforce the application's built-in CAPTCHA and account lockout mechanisms (NeedCaptcha/WrongAuthCount) when validating API tokens submitted via the Authorization header or the token query parameter.\nThis absence of rate limiting allows an unauthenticated remote attacker to execute unlimited automated brute-force attacks against the API token.\nSuccessful exploitation enables attackers to guess weak or short custom tokens, yielding full RoleAdministrator access.\nWith administrative privileges, adversaries can perform arbitrary file operations and execute SQL queries against the underlying database, severely compromising the confidentiality, integrity, and availability of the affected system.",
  "technicalDetails": "The vulnerability is rooted in the CheckAuth() middleware of the SiYuan kernel, which processes authentication credentials for API endpoints.\nThe middleware accepts authentication tokens (Conf.Api.Token) supplied through standard HTTP mechanisms, specifically the Authorization header (utilizing Token or Bearer schemes) or the token query parameter.\nUnlike standard authentication flows within the application, neither of these ingestion paths integrates with the application's security safeguards, namely the NeedCaptcha and WrongAuthCount mechanisms designed to mitigate brute-force attacks.\nDue to this architectural oversight, the application does not track failed authentication attempts or impose delays, lockouts, or CAPTCHA challenges after multiple incorrect submissions.\nAn unauthenticated remote attacker leverages this lack of restriction by launching automated scripts to send high-volume HTTP requests containing sequential or dictionary-based guesses for the API token.\nIf a weak or insufficiently randomized custom token has been configured by the administrator, the brute-force attack quickly succeeds.\nUpon successful token validation, the middleware grants the session full RoleAdministrator privileges.\nArmed with administrative access, the attacker can leverage post-exploitation capabilities inherent to the administrative interface, including executing arbitrary file operations on the host filesystem and executing arbitrary SQL queries.\nThe affected versions comprise all SiYuan kernel releases prior to version 3.7.4."
}