SiYuan versions prior to 3.7.4 contain an unthrottled brute‑force weakness in the Publish Service’s Basic Authentication. The vulnerability permits any remote attacker to submit unlimited guesses against the configured publish‑viewer accounts until the correct credential is found, potentially exposing all published content.

This flaw impacts installations of SiYuan from any vendor that has not applied the 3.7.4 release, specifically those using the default Publish Service listener on TCP port 6808. The affected product is SiYuan Notes, and the vulnerability applies to all product releases before 3.7.4.

With a CVSS score of 8.7 the vulnerability is considered High severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified, but the absence of rate limiting or lockout mechanisms makes exploitation trivial for an attacker with network access to port 6808. The vulnerability is not listed in CISA’s KEV catalog, but the potential for widespread data exposure warrants prompt action.