CVE-2026-72793

Deferred Deferred - Pending Action

SiYuan Information Disclosure Before v3.7.4

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72793

EUVD

EUVD-2026-57453

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)
siyuan	siyuan	to 3.7.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

SiYuan versions before v3.7.4 expose sensitive configuration fields in the /api/system/getConf endpoint. This allows anonymous or low-privilege users to access the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge session cookies to impersonate users and escalate privileges to admin if access-auth codes are not configured.

Detection Guidance

To detect this vulnerability, check if your SiYuan instance is running a version before v3.7.4. Use the endpoint /api/system/getConf to see if sensitive fields like session-cookie signing key, OS username, or encrypted-notebook key material are exposed. If these values are visible without authentication, the system is vulnerable.

Impact Analysis

Unauthorized users can access sensitive data like session keys and OS usernames. Attackers may impersonate users, manipulate session cookies, and gain admin privileges on unprotected instances. This could lead to data breaches, unauthorized access, and full system compromise.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates securing protected health information. The exposure of session keys and user data could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade SiYuan to version v3.7.4 or later immediately. If upgrading is not possible, restrict access to the /api/system/getConf endpoint and ensure access-auth codes are configured to prevent unauthorized access.

Hi! I’m here to help you understand CVE-2026-72793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70