CVE-2026-72793 in SiYuan
Summary
by MITRE • 08/12/2026
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in SiYuan versions prior to v3.7.4 represents a critical information disclosure flaw that undermines the application's authentication and authorization mechanisms. This weakness exists within the /api/system/getConf endpoint which improperly exposes sensitive configuration parameters to unauthorized users. The endpoint failure to mask critical security elements creates a pathway for attackers to extract session-cookie signing keys, operating system usernames through pandoc path references, and encrypted-notebook key material that should remain confidential. Such exposure fundamentally compromises the integrity of the application's security model by providing adversaries with the cryptographic materials necessary to manipulate authentication tokens.
The technical implementation flaw stems from inadequate input validation and output sanitization within the system configuration retrieval mechanism. When the /api/system/getConf endpoint processes requests, it fails to properly filter sensitive fields before returning responses to clients who may not possess elevated privileges. This design oversight allows anonymous users or those with minimal permissions such as publish-readers to access configuration data that should be restricted to administrative or system-level access. The vulnerability specifically affects the exposure of session-cookie signing keys which are fundamental to maintaining user authentication state and preventing unauthorized access to protected resources.
The operational impact of this vulnerability extends beyond simple information disclosure to encompass full authentication bypass capabilities. Attackers who successfully obtain the session-cookie signing key can forge valid session tokens, effectively impersonating legitimate users within the SiYuan application. This capability becomes particularly dangerous when combined with the exposure of encrypted-notebook key material, which could enable attackers to decrypt sensitive data stored within the system. In environments where access-auth codes are not configured, these compromised credentials provide direct pathways to administrative privileges, allowing full control over the entire SiYuan instance and all associated user data.
The security implications align with CWE-200 (Information Disclosure) and CWE-312 (Sensitive Data Exposure) classifications, while also mapping to ATT&CK technique T1566 (Phishing) and T1550 (Use of Unsecured Credentials). Organizations running vulnerable versions face significant risk of unauthorized data access, privilege escalation, and potential complete system compromise. The vulnerability's exploitation requires minimal technical expertise and can be automated, making it particularly dangerous in production environments where such exposures may persist undetected for extended periods.
Mitigation strategies should prioritize immediate deployment of SiYuan v3.7.4 or later versions that address the configuration field masking issue. System administrators must also implement network-level controls to restrict access to the /api/system/getConf endpoint and ensure proper authentication mechanisms are in place for all API endpoints. Regular security auditing of application configurations and continuous monitoring of unauthorized access attempts should be implemented alongside these remediation efforts to prevent exploitation of similar vulnerabilities in other system components.