CVE-2026-72793
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
SiYuan before v3.7.4 fails to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.
Risk Assessment
Risk of account takeover, privilege escalation, and data confidentiality breach.
Recommendation
Update SiYuan to version 3.7.4 or later, which masks sensitive configuration fields.
Original NVD description (English source)
SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to obtain the session-cookie signing key, OS username via pandoc path, and encrypted-notebook key material. Attackers can forge and tamper with session cookies to impersonate users, and on instances without access-auth codes configured, escalate to administrator privileges.