CVE-2026-73056 - SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API Token
Brief
CVE ID : CVE-2026-73056
Published : Aug. 16, 2026, 2:16 p. m.
- 6 hours, 50 minutes ago
Description : SiYuan kernel versions before 3.
- 4 contain an improper restriction of excessive authentication attempts vulnerability in the CheckAuth() middleware. The middleware accepts the API token (Conf. Api. Token) via an Authorization header (Token/Bearer) or a ? token= query parameter, and neither path is protected by the application's CAPTCHA/lockout mechanism (NeedCaptcha/WrongAuthCount).
As a result, an unauthenticated remote attacker can perform unlimited automated guesses of the API token, particularly when a short or weak custom token has been configured, and upon success gains full RoleAdministrator access enabling arbitrary file operations and SQL queries.
Severity: 9.8
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...