CVE-2026-73045 describes an improper restriction of excessive authentication attempts vulnerability in SiYuan note-taking software versions prior to 3.7.4. The flaw exists in the authFilePublishAccess endpoint, which lacks mechanisms such as rate limiting or CAPTCHA to prevent unauthenticated attackers from submitting unlimited password guesses. This allows brute-force attacks against per-notebook publish passwords, potentially compromising access to protected published notebooks.

An attacker can repeatedly attempt to guess publish passwords without limitation, increasing the likelihood of unauthorized access to password-protected notebooks. This compromises the confidentiality of published notebook content. The vulnerability is exploitable remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or CAPTCHA protections on the authFilePublishAccess endpoint to mitigate brute-force attempts.