The vulnerability in SiYuan versions prior to 3.7.4 lies in the CheckAuth() middleware's handling of HTTP Basic Authentication. The middleware accepts the workspace access code as the Basic Auth password but bypasses CAPTCHA and lockout controls that are applied to cookie/session login paths. This allows attackers to perform unlimited automated brute-force attempts against the admin access code without incrementing failure counters or triggering lockouts. Furthermore, the access code comparison is done using a non-constant-time string comparison, potentially enabling timing attacks. Successful exploitation grants full RoleAdministrator privileges to the attacker.

An unauthenticated remote attacker can brute-force the workspace access code without restriction, potentially gaining full administrative access (RoleAdministrator) to the SiYuan kernel. This could lead to complete compromise of the affected system. The vulnerability has a high CVSS score of 9.3, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /api/* endpoints via network controls, implement external rate limiting, and monitor for suspicious authentication attempts. Avoid exposing the service to untrusted networks. Do not rely on the current authentication mechanism as it does not enforce lockout or CAPTCHA protections.