CVE-2026-73046 affects SiYuan note-taking software versions before 3.7.4. The vulnerability lies in the CheckAuth() middleware where the HTTP Basic Authentication branch accepts the workspace access code as the Basic Auth password but bypasses CAPTCHA and lockout controls that apply to the cookie/session login path. This allows unauthenticated remote attackers to perform unlimited automated brute-force attempts against the admin access code, potentially gaining full administrative privileges. A secondary issue is the use of a non-constant-time string comparison for the access code, which could be exploited to reduce the effort needed to guess the code.

An unauthenticated remote attacker can brute-force the workspace access code without restriction, potentially gaining full RoleAdministrator access to the SiYuan kernel. This grants complete control over the affected system. The lack of rate limiting or CAPTCHA enforcement significantly increases the risk of successful brute-force attacks. The non-constant-time comparison further aids attackers by enabling timing analysis to guess the access code more efficiently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/* endpoints through network controls or reverse proxies to limit exposure. Monitor for unusual authentication attempts and consider implementing external rate limiting or CAPTCHA mechanisms if possible.