CVE-2026-72794 in Siyuan
Summary
by MITRE • 08/12/2026
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in siyuan versions prior to v3.7.4 represents a critical security flaw that exposes sensitive authentication infrastructure through an improperly protected API endpoint. The /api/system/getConf endpoint, which should only be accessible to authenticated administrators, fails to enforce proper access controls when the application operates in publish mode. This configuration allows any unauthenticated attacker to retrieve the session cookie signing key through a simple HTTP request, fundamentally undermining the application's authentication security model.
This technical flaw constitutes a direct violation of secure authentication practices and can be categorized under CWE-287 which addresses improper authentication mechanisms. The exposure of the CookieKey value creates an immediate pathway for attackers to forge valid session cookies, effectively bypassing all session management controls that should protect user sessions. The vulnerability is particularly severe because it eliminates the need for credentials or privilege escalation techniques, allowing attackers to directly impersonate any user within the system.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass full administrative control over affected siyuan instances. Attackers can leverage the retrieved signing key to generate valid session cookies for arbitrary users, including administrators, enabling them to perform privileged actions such as modifying content, accessing sensitive data, managing user accounts, and potentially escalating their privileges within the application. The publish mode configuration exacerbates this risk by exposing administrative functionality to unauthenticated parties without proper authorization checks.
This vulnerability aligns with ATT&CK technique T1566 which covers credential harvesting through social engineering and direct exploitation of authentication mechanisms. The attack surface is particularly dangerous because it allows for persistent unauthorized access without requiring additional reconnaissance or exploitation techniques beyond simple API enumeration. Organizations running vulnerable versions of siyuan face immediate risk of data compromise, content manipulation, and potential lateral movement within their network infrastructure through the compromised application.
The recommended mitigation strategy involves upgrading to siyuan version 3.7.4 or later where the /api/system/getConf endpoint properly enforces authentication requirements regardless of publish mode configuration. Additionally, administrators should implement network-level access controls to restrict exposure of administrative APIs, employ proper input validation on all endpoints, and conduct regular security assessments to identify similar misconfigurations. Organizations should also consider implementing session management best practices including secure cookie attributes, proper session timeout mechanisms, and regular key rotation procedures to minimize the impact of potential credential exposure events.