CVE-2026-73045CWE-307

CVE-2026-73045

High · published August 16, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00520 · 43.3th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-08-16T02:16Z
References (3)
https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v · [email protected]https://www.vulncheck.com/advisories/siyuan-before-brute-force-via-authfilepublishaccess · [email protected]https://github.com/siyuan-note/siyuan/security/advisories/GHSA-v362-968x-gp2v · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 15 AUG 21:44Z
    SiYuan before 3.7.4 Brute-Force via authFilePublishAccess
    cvelistv5