CVSS
9.8
CVSS v3.1
EPSS
N/A
Exploit Prediction Score
Published
August 15, 2026
Exploitability
No EPSS data available
SiYuan before v3.7.4 improperly restricts excessive authentication attempts in the CheckAuth() middleware. The HTTP Basic Authentication branch, which guards nearly the entire /api/* surface, accepts the workspace access code (Conf.AccessAuthCode) as the Basic Auth password but never consults the CAPTCHA/lockout gate or increments the failure counter used by the cookie/session login path. This allows unauthenticated remote attackers to brute-force the admin access code with unlimited automated requests and obtain full RoleAdministrator access to the kernel. A secondary weakness exists because the access code is compared using a non-constant-time string comparison.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).