Sensitive configuration disclosure in SiYuan via /api/system/getConf (CVE-2026-72793)

The `/api/system/getConf` endpoint in SiYuan is reachable by anonymous users and publish-reader tokens, and its non-administrator masking chain fails to suppress three fields that the configuration-export path explicitly clears: the session-cookie signing key (`Conf.CookieKey`), an absolute path embedding the OS username (`Conf.Export.PandocBin`), and encrypted-notebook key material (`Conf.NotebookCrypto`). Because the session-cookie signing key is the live HMAC secret used to authenticate all session cookies, an attacker who obtains it can mint and modify session cookies the server accepts as authentic. On instances without an access-auth code configured, this allows escalation to administrator privileges; disclosure of the persistent cryptographic secret to unauthenticated parties is unconditional on every affected instance. Affected versions: - <=v3.7.3 We recommend updating to: v3.7.4. CVSS 9.2 · our assessment: act_now Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-h4v5-crx2-3cv4 Details: https://vuln.today/cve/CVE-2026-72793