A critical authentication brute-force vulnerability in SiYuan kernel versions prior to 3.7.4 allows unauthenticated attackers to gain full administrative access.

The CheckAuth middleware fails to enforce rate limiting or CAPTCHA requirements on API token authentication. This allows an unauthenticated remote attacker to perform unlimited brute-force guesses against the API token, leading to full RoleAdministrator access.

With a CVSS score of 9.8, this flaw presents a critical risk, as it allows attackers to gain full control over the application. Administrative access grants the ability to perform arbitrary file operations and execute SQL queries, leading to potential data exfiltration or complete loss of system integrity.

Immediate Action: Update siyuan-note siyuan to version 3.7.4 or later immediately to apply the necessary authentication rate limiting.

Proactive Monitoring: Review audit logs for high volumes of failed API authentication attempts or suspicious patterns originating from single IP addresses.

Compensating Controls: If an immediate update is not feasible, implement a Web Application Firewall (WAF) rule to rate-limit requests to API endpoints or block unauthorized IP addresses exhibiting rapid authentication failures.

Public Exploit Available: No (No confirmed weaponized exploit is documented in the provided data.)

This vulnerability is highly critical due to the ease of brute-forcing API tokens. All deployments of SiYuan must be updated to version 3.7.4 or later as the primary mitigation. Ensure that API tokens are sufficiently long and complex to further reduce the risk of successful guessing.