CVE-2026-72794
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
SiYuan before v3.7.4 exposes the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.
Risk Assessment
Risk of user account takeover and privilege escalation to administrator level.
Recommendation
Update SiYuan to version 3.7.4 or later, which removes the exposure of the cookie signing key.
Original NVD description (English source)
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.