CVE-2026-74868 describes an unthrottled brute-force vulnerability in SiYuan's Publish Service Basic Authentication mechanism. The Publish Service listens on a separate, unauthenticated-by-default TCP port (6808) and uses Basic Auth to protect named publish-viewer accounts. However, it lacks any rate limiting, per-account lockout, or backoff mechanisms, allowing unauthenticated attackers to submit unlimited password guesses against these accounts. This flaw exists in versions prior to 3.7.4, specifically in the PublishServiceTransport.RoundTrip() function within kernel/server/proxy/publish.go.

An unauthenticated remote attacker can perform unlimited brute-force password attempts against named publish-viewer accounts, potentially gaining unauthorized access to published notes and notebooks. This compromises confidentiality of published content. There is no indication of privilege escalation or impact beyond unauthorized access to published data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting network access to the Publish Service port (default TCP 6808) to trusted hosts only, or implement external rate limiting controls. Monitor for unusual authentication attempts on the Publish Service. Avoid exposing the Publish Service listener to untrusted networks.