CVE-2026-74868 describes an improper restriction of excessive authentication attempts in the SiYuan Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on an unauthenticated-by-default listener on TCP port 6808 and protects named publish-viewer accounts with Basic Auth that lacks any rate limiting, per-account lockout, or backoff. This allows unauthenticated remote attackers to submit unlimited password guesses against these accounts, potentially gaining unauthorized access to published notes and notebooks. The vulnerability affects SiYuan versions before 3.7.4. No official patch or remediation guidance is currently available.

The vulnerability allows unauthenticated remote attackers to perform unlimited brute-force password attempts against named publish-viewer accounts, potentially leading to unauthorized access to published notes and notebooks. This compromises confidentiality of published content. The CVSS 4.0 score is 8.7 (high severity) with network attack vector, no privileges required, no user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting network access to the Publish Service listener on TCP port 6808 to trusted hosts only or disabling the Publish Service if not needed to reduce exposure to brute-force attacks.