CVE-2026-74868— SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| siyuan-note | siyuan | < 3.7.4 | affected |
3.7.4 | unaffected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-74868
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
Source: CVE Program / CVE List V5
Vulnerability Description
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-default listener (default TCP port 6808) and gates named publish-viewer accounts (Conf.Publish.Auth.Accounts) with Basic Auth that has no rate limiting, per-account lockout, or backoff. Unauthenticated remote attackers can submit unlimited password guesses against named accounts to gain access to published notes/notebooks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
过多认证尝试的限制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| siyuan-note | siyuan | 0 ~ 3.7.4 | - |
II. Public POCs for CVE-2026-74868
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74868
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-74868 (2)
- 🔗 Unthrottled brute-force of Publish Service Basic Auth accounts in `PublishServiceTransport.RoundTrip()`, allowing unlimited automated guessing of named publish-viewer passwords on a separate, unauthenticated-by-default port · Advisory · siyuan-note/siyuan · GitHub Read full article vendor-advisory
Same Patch Batch · siyuan-note · 2026-08-17 · 7 CVEs total
| CVE-2026-74799 | 9.3 CRITICAL | SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure |
| CVE-2026-74800 | 9.0 CRITICAL | SiYuan before v3.7.4 Stored XSS via assets endpoint |
| CVE-2026-74798 | 8.7 HIGH | SiYuan kernel Path Traversal via database_clean MCP tool |
| CVE-2026-74801 | 8.2 HIGH | SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe |
| CVE-2026-74802 | 8.2 HIGH | SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy |
| CVE-2026-74867 | 4.2 MEDIUM | SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth |
IV. Related Vulnerabilities
Same product: siyuan
- CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint - CVE-2026-74798
SiYuan kernel Path Traversal via database_clean MCP tool
Same vendor: siyuan-note
- CVE-2026-74867
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth - CVE-2026-74802
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network prox - CVE-2026-74801
SiYuan before 3.7.4 Local Privilege Escalation via elevator. - CVE-2026-74800
SiYuan before v3.7.4 Stored XSS via assets endpoint - CVE-2026-74798
SiYuan kernel Path Traversal via database_clean MCP tool
Same weakness: CWE-307
- CVE-2026-73056
SiYuan kernel before 3.7.4 Unthrottled Brute-Force via API T - CVE-2026-73046
SiYuan before v3.7.4 Authentication Bypass via HTTP Basic Au - CVE-2026-73045
SiYuan before 3.7.4 Brute-Force via authFilePublishAccess - CVE-2026-19898
VictoriaMetrics VMAuth Authentication Endpoint main.go reque - CVE-2026-19897
mangroup dtale Login Endpoint auth.py login excessive authen
V. Comments for CVE-2026-74868
No comments yet