CVE-2026-73045: brute-force bypass of notebook

CISO Take

SiYuan before version 3.7.4 fails to rate-limit or CAPTCHA-protect the authFilePublishAccess endpoint, letting an unauthenticated attacker submit unlimited password guesses against any password-protected published notebook. The CVSS 7.5 score reflects a full confidentiality break with no privileges or user interaction required, and EPSS places it in the top 77th percentile for likelihood of exploitation despite the low absolute EPSS value, so it is not a theoretical risk. There is no CISA KEV listing, no known public exploit, and no Nuclei template yet, meaning exploitation would require a custom brute-force script rather than a point-and-click tool. Because SiYuan notebooks are often used to store internal documentation, research notes, or knowledge bases (including AI/security-related content), a successful brute force could leak sensitive material without leaving obvious traces. Upgrade to SiYuan 3.7.4 or later immediately; if patching is delayed, disable public notebook publishing or front the publish endpoint with an external rate limiter/WAF rule, and review access logs for repeated failed password attempts against publish endpoints.

Sources:NVDEPSSGitHub AdvisoryATLAS

What is the risk?

High confidentiality risk with low exploitation complexity: no authentication, no user interaction, and network-reachable (AV:N/AC:L/PR:N/UI:N). The absence of rate limiting or CAPTCHA on authFilePublishAccess means the only real barrier is password strength, which is entirely within the attacker's control to grind through. Mitigating factors are the lack of CISA KEV inclusion, no observed public exploit code, and no Nuclei template, which suggests exploitation is not yet automated at scale. Overall this is a moderate-urgency patch item: trivial to exploit once targeted, but requires the attacker to specifically target a SiYuan publish endpoint rather than being part of mass internet scanning today.

How does the attack unfold?

Recon

Attacker identifies a publicly reachable SiYuan instance with a password-protected published notebook.

AML.T0049

Brute-force exploitation

Attacker scripts unbounded password guesses against the authFilePublishAccess endpoint, which has no rate limiting or CAPTCHA.

AML.T0106

Unauthorized access

Attacker obtains the correct publish password and gains full read access to the protected notebook's contents.

Recon

Attacker identifies a publicly reachable SiYuan instance with a password-protected published notebook.

AML.T0049

Brute-force exploitation

Attacker scripts unbounded password guesses against the authFilePublishAccess endpoint, which has no rate limiting or CAPTCHA.

AML.T0106

Unauthorized access

Attacker obtains the correct publish password and gains full read access to the protected notebook's contents.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

INone

ANone

What should I do?

1 step

1) Upgrade to SiYuan 3.7.4 or later, which is expected to add rate limiting/lockout on authFilePublishAccess. 2) Until patched, disable or restrict public notebook publishing for any notebook containing sensitive content. 3) If publishing must stay enabled, place the publish endpoint behind an external reverse proxy or WAF rule that enforces request throttling per IP/session on authentication endpoints. 4) Use long, high-entropy publish passwords to raise the brute-force cost as a stopgap. 5) Monitor logs for bursts of failed authFilePublishAccess attempts as a detection signal, and rotate publish passwords for any notebook that shows suspicious access patterns.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPluginAML.T0049- Exploit Public-Facing Application AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

Frequently Asked Questions

What is CVE-2026-73045?

SiYuan before version 3.7.4 fails to rate-limit or CAPTCHA-protect the authFilePublishAccess endpoint, letting an unauthenticated attacker submit unlimited password guesses against any password-protected published notebook. The CVSS 7.5 score reflects a full confidentiality break with no privileges or user interaction required, and EPSS places it in the top 77th percentile for likelihood of exploitation despite the low absolute EPSS value, so it is not a theoretical risk. There is no CISA KEV listing, no known public exploit, and no Nuclei template yet, meaning exploitation would require a custom brute-force script rather than a point-and-click tool. Because SiYuan notebooks are often used to store internal documentation, research notes, or knowledge bases (including AI/security-related content), a successful brute force could leak sensitive material without leaving obvious traces. Upgrade to SiYuan 3.7.4 or later immediately; if patching is delayed, disable public notebook publishing or front the publish endpoint with an external rate limiter/WAF rule, and review access logs for repeated failed password attempts against publish endpoints.

Is CVE-2026-73045 actively exploited?

No confirmed active exploitation of CVE-2026-73045 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-73045?

1) Upgrade to SiYuan 3.7.4 or later, which is expected to add rate limiting/lockout on authFilePublishAccess. 2) Until patched, disable or restrict public notebook publishing for any notebook containing sensitive content. 3) If publishing must stay enabled, place the publish endpoint behind an external reverse proxy or WAF rule that enforces request throttling per IP/session on authentication endpoints. 4) Use long, high-entropy publish passwords to raise the brute-force cost as a stopgap. 5) Monitor logs for bursts of failed authFilePublishAccess attempts as a detection signal, and rotate publish passwords for any notebook that shows suspicious access patterns.

What systems are affected by CVE-2026-73045?

This vulnerability affects the following AI/ML architecture patterns: Knowledge management / notebook publishing platforms.

What is the CVSS score for CVE-2026-73045?

CVE-2026-73045 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

Knowledge management / notebook publishing platforms

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

What are the technical details?

Original Advisory

SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.

Exploitation Scenario

An attacker discovers a publicly reachable SiYuan instance with a password-protected published notebook (e.g., via search engine indexing or direct URL enumeration). They write a simple script that repeatedly submits password guesses to the authFilePublishAccess endpoint with no delay, since the server neither rate-limits nor challenges repeated failures. Given enough time and a weak or moderate-strength password, the script eventually finds the correct password and gains full read access to the notebook's contents, potentially exposing internal notes, credentials, or proprietary information the owner believed were protected.

Weaknesses (CWE)

CWE-307Improper Restriction of Excessive Authentication AttemptsPrimary CWE-307Improper Restriction of Excessive Authentication Attempts

CWE-307 — Improper Restriction of Excessive Authentication Attempts: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

[Architecture and Design] Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Source: MITRE CWE corpus.