Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

SiYuan kernel API tokens can be guessed too easily

CVE-2026-73056 · published 18 days ago
Summary

Old versions of the SiYuan kernel have a weakness in how they handle API tokens. This makes it easy for an attacker to try many different tokens until they find the right one. To fix this, update to version 3.7.4 or later.

What to do
  • Update siyuan-note siyuan to version 3.7.4 or later.
Affected software
VendorProductAffected versions
siyuan-note siyuan < 3.7.4
Original advisory text
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api....
SiYuan kernel versions before 3.7.4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf.Api.Token) via an Authorization header (Token/Bearer) or a ?token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount). As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published16 Aug 2026
Updated3 Sep 2026
First seen16 Aug 2026
Sources
CVE-2026-73056 · NVD
CVE-2026-73056 · MITRE
Monitor software like this
Free during beta