CVE-2026-73045 describes an improper restriction of excessive authentication attempts vulnerability in SiYuan note-taking software prior to version 3.7.4. The vulnerability exists in the authFilePublishAccess endpoint, which lacks mechanisms such as rate limiting or CAPTCHA to prevent brute-force attacks. As a result, unauthenticated attackers can submit unlimited password guesses against per-notebook publish passwords, increasing the risk of unauthorized access to protected notebooks.

The vulnerability allows unauthenticated attackers to brute-force password-protected published notebooks without restriction, potentially leading to unauthorized disclosure of sensitive notebook content. The CVSS 4.0 base score of 8.7 (high severity) reflects the network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external protections such as web application firewalls or rate limiting proxies to mitigate brute-force attempts on the authFilePublishAccess endpoint.