Originally published at HOL
BREAKING: CVE-2026-73046 - SiYuan Basic Auth Lockout Bypass Enables Admin Brute Force
TL;DR: SiYuan's network authentication has two paths for the same workspace lock-screen credential, but only one is protected by CAPTCHA and lockout controls. In versions before 3.7.4, the HTTP Basic Auth branch inside CheckAuth() accepts unlimited password guesses without incrementing WrongAuthCount or calling NeedCaptcha(). Once the correct access code is guessed, the request receives RoleAdministrator. CVE-2026-73046 is CVSS 9.8 CRITICAL under CVSS 3.1 and maps to CWE-307. The CVE record marks 3.7.4 fixed. SiYuan's current stable release is 3.8.0, so operators should upgrade to 3.8.0 or later.
What happened
SiYuan uses a workspace lock-screen password, stored as Conf.AccessAuthCode, to protect network-reachable kernel deployments. The normal session login path and the HTTP Basic Auth path both accept that same secret.
The normal LoginAuth() path has brute-force protection. It checks NeedCaptcha(), and failed access-code attempts increment WrongAuthCount. After repeated failures, the application requires a CAPTCHA before it will continue checking the credential.
The Basic Auth branch in CheckAuth() does not use either control. The upstream advisory shows the middleware reading the HTTP Basic Auth username and password, comparing them directly with the workspace name and Conf.AccessAuthCode, and assigning RoleAdministrator when they match. Failed Basic Auth attempts do not increment the counter and do not trigger the CAPTCHA gate.
The result is a second authentication path around the rate limit. An attacker can send automated Basic Auth requests against the network-exposed kernel until the access code is guessed. The advisory also notes that the access-code comparison uses a normal Go string comparison rather than a constant-time comparison, but the primary issue is the missing restriction on repeated guesses.
Why the impact is critical
The CVE CNA assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, or 9.8 CRITICAL. The CVSS 4.0 score is 9.3 CRITICAL. No existing privileges or user interaction are required.
A successful guess does not produce a limited session. It grants RoleAdministrator. The upstream advisory lists administrator capabilities including arbitrary file read and write through the file APIs, SQL query execution, full workspace export, plugin RPC, and process control.
This matters especially for self-hosted deployments exposed on a LAN or VPS. SiYuan's official Docker instructions document serving the kernel on port 6806 with --accessAuthCode as the network access control. The project also now ships MCP support and an AI Agent in the stable 3.8.0 release, increasing the value of protecting the knowledge base and its automation surface.
Affected and fixed versions
The CVE record marks SiYuan versions before 3.7.4 as affected and 3.7.4 as fixed. The upstream advisory confirms the flaw in 3.7.3 and describes the mechanism as architectural rather than a recent regression.
SiYuan published stable 3.8.0 on August 12, 2026. Because 3.8.0 is newer than the patched boundary, it is the clearest current stable upgrade target.
What to do
Desktop and mobile users: update SiYuan through your normal app store or the official release package to version 3.8.0 or later.
Docker operators: pull the current stable image and redeploy your existing configuration:
docker pull b3log/siyuan:v3.8.0
If your Compose file pins an older image, update it to:
image: b3log/siyuan:v3.8.0
Then recreate the service using your normal deployment process. Since SiYuan 3.7.0, self-hosted kernel deployments require the explicit serve subcommand.
If you cannot patch immediately, reduce exposure rather than relying on a weak access code. Restrict port 6806 to trusted networks or VPN users at the firewall or reverse proxy, and replace short lock-screen passwords with a long, high-entropy value. Those steps reduce brute-force feasibility but do not fix the missing lockout path.
Detection and review
Review reverse-proxy and application logs for repeated HTTP Basic Auth failures against /api/*, especially high-frequency requests from one source or distributed attempts across many source addresses. After patching, inspect the workspace and host for unexpected administrator activity, file changes, SQL operations, plugin changes, or process-control activity if you suspect the access code was guessed.
