SiYuan EUVD-2026-57453

The affected instance must be running SiYuan before v3.7.4 and be network-reachable by the attacker; the /api/system/getConf endpoint is accessible to anonymous or publish-reader users, so no authentication is required to obtain the leaked secrets (CVSS PR:N confirms unauthenticated access). The full escalation to administrator specifically requires that the instance has NOT been configured with an access-auth code - this is the key limiting factor: instances with an access-auth code set still leak the configuration secrets but constrain the anonymous admin-takeover path. No user interaction is needed (UI:N), and exploitation works against default configurations that expose the service without an access-auth code.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, base 9.2) indicates a network-reachable, low-complexity, unauthenticated attack with no user interaction, and the VC:H/SC:H metrics reflect both direct credential disclosure and downstream subsequent-system impact (impersonation/admin takeover). The severity is driven by the chained consequence: leaking the cookie signing key enables cookie forgery and, absent an access-auth code, administrator escalation. No EPSS score, KEV listing, or POC was provided in the input, so there is no confirmed active exploitation - the risk rests on the low barrier to entry and clear impact rather than observed attacks. One nuance to verify: exploitation of the full admin-escalation path is conditioned on the target instance NOT having an access-auth code configured; instances with access-auth still leak the secrets but the escalation step is constrained.

An attacker who can reach a SiYuan instance over the network - either fully anonymously or as a publish-reader - sends a request to /api/system/getConf and reads back the unmasked session-cookie signing key. Using that key they forge a signed session cookie for a target account (or an administrator), and on an instance without an access-auth code configured they obtain full administrative control. No public exploit code was identified at time of analysis, but the attack requires only a single unauthenticated HTTP request to obtain the secrets.