External risk intelligence

SiYuan Authentication Bypass via HTTP Basic Auth

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73046

SiYuan is a note-taking application that exposes an API surface guarded by authentication. This functionality is often deployed as a web-accessible service, making the /api/* endpoints reachable by remote attackers.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in SiYuan software that allows unauthenticated remote attackers to bypass authentication and gain full administrator access. The issue stems from an improper restriction of authentication attempts in the middleware, enabling brute-force attacks on the admin access code.

Unauthenticated access grants full admin control.
Remember this for potential unauthorized system access.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated remote attacker can bypass authentication by repeatedly sending specially crafted requests to the API. This allows them to brute-force the administrative access code without being detected by security measures, ultimately gaining full administrative control over the system.

Attacker needs network access.
Brute-force admin access code.
Full administrator access gained.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and gain full administrative access to the SiYuan kernel when its API is exposed. This is possible because the system does not properly enforce authentication attempts or lock out suspicious activity, allowing for brute-force attacks against the admin access code.

Full administrative access to the kernel.
Unlimited automated requests to bypass authentication.
Unauthorized access to all workspace data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners responsible for SiYuan deployments should initiate a discovery process to locate all instances of the affected technology. The immediate priority is to determine if any instances are exposed to the internet or accessible by unauthenticated remote attackers. Once confirmed, accountable owners must be identified to plan remediation, potentially involving vendor coordination or temporary risk reduction measures, based on the assessed business criticality and exposure.

Identify accountable application owners.
Verify internet exposure and reachability.
Plan coordinated remediation efforts.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SiYuan?

SiYuan is a self-hosted, open-source note-taking application designed for privacy and local knowledge management. It provides a robust API that powers its workspace features, allowing users to interact with their data through various endpoints. While often run locally for personal use, its architecture allows it to be deployed as a web service accessible over a network.

What does CVE-2026-73046 mean for security?

This CVE describes a flaw in how the software handles login attempts, classified as CWE-307: Improper Restriction of Excessive Authentication Attempts. In simple terms, the application's authentication middleware fails to track or limit failed password guesses when using HTTP Basic Authentication. Because the system does not implement a lockout mechanism or slow down requests, an attacker can automate endless attempts to guess the administrative access code.

How can an attacker trigger this vulnerability?

An attacker needs network access to the target SiYuan instance to send automated HTTP requests to the API. The bug specifically affects the HTTP Basic Authentication path; it does not impact traditional cookie-based or session-based logins, which utilize separate code paths that do track failed attempts. Successful exploitation relies on the lack of a rate-limiting gate or failure counter on the Basic Auth branch.

Why should I care if my SiYuan instance is internet-facing?

Halo Surface Signal indicates that SiYuan deployments are often configured as web-accessible services, making them reachable by remote parties. If your instance is exposed to the internet, any remote attacker can reach the vulnerable API endpoints without needing prior access to your network. This significantly increases the risk, as the system provides no defense against automated brute-force attacks on the administrative password.

How do I secure my SiYuan installation?

Your first step is to locate all active SiYuan deployments in your environment and determine if they are reachable from the internet or untrusted networks. Identify who is responsible for each instance to coordinate an update. Since the vulnerability is fixed in version 3.7.4, ensure you are running that version or newer to gain proper protection against authentication brute-forcing.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.