Description

SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T11:16:41.030Z",
  "pubdate": "2026-08-17T11:16:41.030Z",
  "executiveSummary": "SiYuan versions before 3.7.4 suffer from an unthrottled brute-force vulnerability within the Publish Service Basic Auth implementation. This security flaw impacts the Publish Service running on a separate, unauthenticated-by-default TCP listener on port 6808, which gates named publish-viewer accounts defined in Conf.Publish.Auth.Accounts.\nThe vulnerability arises from the complete absence of rate limiting, per-account lockout mechanisms, or exponential backoff algorithms within the authentication routine. Consequently, unauthenticated remote attackers can submit an unlimited volume of password guesses against targeted named accounts.\nSuccessful exploitation allows unauthorized threat actors to bypass authentication controls and gain complete access to sensitive published notes and notebooks stored within the affected SiYuan instance.\nThe risk implications include unauthorized disclosure of confidential data and potential exposure of sensitive enterprise or personal knowledge bases hosted via the publication feature. The attack vector is entirely remote, requiring network connectivity to the exposed publish service port without requiring any prior authentication or special privileges.",
  "technicalDetails": "The vulnerability resides in the Publish Service Basic Auth implementation handled by the PublishServiceTransport.RoundTrip() function located in the kernel/server/proxy/publish.go file of the SiYuan codebase. SiYuan versions prior to 3.7.4 are affected by this flaw.\nThe root cause of the vulnerability is the lack of request throttling, account lockout policies, or progressive delays for failed authentication attempts. The underlying HTTP transport round-trip logic processes incoming HTTP Authorization headers containing HTTP Basic credentials against the configured accounts array (Conf.Publish.Auth.Accounts) synchronously and repeatedly without imposing any operational restrictions on submission frequency.\nThe network exposure involves a separate listener operating on TCP port 6808 by default, which is unauthenticated by default and exposes the publish-viewer functionality directly to remote network interfaces.\nThe attack flow unfolds sequentially as follows: First, an unauthenticated remote attacker discovers the exposed SiYuan Publish Service listener operating on TCP port 6808. Second, the attacker formulates a automated script to send continuous HTTP requests containing arbitrary or dictionary-based password guesses alongside target usernames within the Authorization header. Third, because PublishServiceTransport.RoundTrip() processes these requests without rate limiting or lockout enforcement, the application validates each credential set independently until a correct password is guessed. Finally, upon successfully guessing the credentials, the attacker achieves unauthorized access to the restricted published notes and notebooks, yielding a direct breach of confidentiality for the targeted published content."
}