The vulnerability lies in the CheckAuth() middleware of SiYuan kernel versions prior to 3.7.4, where API token authentication is not constrained by a CAPTCHA or lockout mechanism. The middleware accepts the token via an Authorization header or a query parameter, allowing an unauthenticated remote attacker to send unlimited credential‑guessing requests. If a short or weak custom token is in use, the attacker can obtain RoleAdministrator access and thereby execute arbitrary file operations and SQL queries. The weakness is a classic credential‑guessing flaw (CWE‑307) and results in full system compromise without any user interaction.

SiYuan‑Note’s SiYuan application, versions before 3.7.4. The vulnerability affects all installations using the default API token mechanism without further safeguards.

The CVSS score of 9.3 indicates critical severity. No EPSS data is available, the vulnerability is not listed in CISA’s KEV catalog, but its nature permits remote brute‑force attacks over any exposed API endpoint. An attacker needs only network access to the application; no special privileges or additional exploits are required. Successful exploitation yields complete administrative control of the affected system.