CVE-2026-72794
CRITICAL
CVSS 9.2
siyuan
Verified Advisory
Session cookie signing key disclosure in siyuan via getConf endpoint (CVE-2026-72794)
The POST /api/system/getConf endpoint in siyuan returns the server's session cookie signing key (Conf.CookieKey) in its response body to unauthenticated users when publish mode is enabled with authentication disabled, or to any publish reader account otherwise. An attacker who retrieves this key can forge arbitrary session cookies that the server accepts as authentic, enabling session impersonation and potential administrative access.
Affected versions:
- <=v3.7.2
We recommend updating to: v3.7.4.
CVSS 9.2 · our assessment: act_now
Reference: https://github.com/siyuan-note/siyuan/security/advisories/GHSA-34fj-mwm6-fjfg
Details: https://vuln.today/cve/CVE-2026-72794
Verified by vuln.today against published advisories.
Affected versions
- – <=v3.7.2
Fixed in: v3.7.4
More advisories for siyuan
- CVE-2026-73608 – Missing authorization in SiYuan getAttributeViewSearchTarget endpoint (CVE-2026-73608)
- CVE-2026-72804 – Missing publish-password check in SiYuan graph API endpoints (CVE-2026-72804)
- CVE-2026-72795 – Publish-access bypass in SiYuan embedded block endpoints (CVE-2026-72795)
- CVE-2026-72798 – Information disclosure in SiYuan publish-mode attribute view filter (CVE-2026-72798)
- CVE-2026-72793 – Sensitive configuration disclosure in SiYuan via /api/system/getConf (CVE-2026-72793)
- CVE-2026-72789 – Authorization bypass in SiYuan encrypted notebook publish access gate (CVE-2026-72789)
- CVE-2026-68584 – Authentication bypass in SiYuan publish-mode password-protected documents (CVE-2026-68584)
- CVE-2026-68586 – Publish-access bypass in SiYuan backlink content endpoints (CVE-2026-68586)