CVE-2026-72794

Deferred Deferred - Pending Action

Sensitive Data Exposure in SiYuan Before v3.7.4

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: VulnCheck

Description

siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72794

EUVD

EUVD-2026-57454

Affected Vendors & Products

Vendor	Product	Version / Range
siyuan	siyuan	to 3.7.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability affects siyuan versions before v3.7.4. It allows unauthenticated attackers to retrieve the session cookie signing key via the /api/system/getConf endpoint when the application is in publish mode. The exposed CookieKey can be used to forge valid session cookies, enabling attackers to impersonate users or gain administrative access.

Detection Guidance

To detect this vulnerability, check if the /api/system/getConf endpoint returns the CookieKey value without authentication. Use curl to query the endpoint: curl -v http://<target>/api/system/getConf. If the response includes Conf.CookieKey, the system is vulnerable.

Impact Analysis

Attackers could impersonate users or gain administrative access by forging session cookies. This could lead to unauthorized data access, modification, or deletion. The impact is severe due to the persistent nature of the exposed key, which cannot be rotated without breaking active sessions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient protection of credentials and session management, potentially leading to data breaches and regulatory penalties.

Mitigation Strategies

Immediately upgrade Siyuan to version 3.7.4 or later. If upgrading is not possible, restrict access to the /api/system/getConf endpoint or disable publish mode until patched.

Hi! I’m here to help you understand CVE-2026-72794. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70