CVE-2026-74868

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4

Description The Publish Service Basic Auth implementation contains a flaw that allows unthrottled brute-force attacks. The service operates on a separate listener, typically TCP port 6808, which is unauthenticated by default. It uses Basic Auth to protect Conf.Publish.Auth.Accounts (publish-viewer accounts) but lacks rate limiting, per-account lockout, or backoff mechanisms. This allows unauthenticated remote attackers to perform unlimited password guesses against these accounts to gain unauthorized access to published notes and notebooks via the PublishServiceTransport.RoundTrip() function.

Recommendations Update to version 3.7.4 or later.