CVE-2026-72794: siyuan before v3.7.4 Session Cookie Key Disclosure via getConf
siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attackers can retrieve the CookieKey value and forge valid session cookies to impersonate users or gain administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
siyuanto a version that resolves this vulnerability.Fixed in v3.7.4 - Compensating control
Ensure /api/system/getConf is not accessible to unauthenticated users (e.g., restrict access via network controls/ACL so CookieKey cannot be retrieved in publish mode).
- Operational
After upgrading, rotate/recreate session-related secrets (CookieKey) so previously exposed CookieKey-derived forged session cookies become invalid.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72794?
The severity of CVE-2026-72794 is classified as high with a score of 8.6.
How do I fix CVE-2026-72794?
To fix CVE-2026-72794, upgrade to SiYuan version 3.7.4 or later.
What does CVE-2026-72794 affect?
CVE-2026-72794 affects SiYuan versions before 3.7.4.
What can an attacker do with CVE-2026-72794?
An attacker can retrieve the session cookie signing key and forge valid session cookies, potentially impersonating users.
Where is the vulnerability in CVE-2026-72794 located?
The vulnerability in CVE-2026-72794 is located in the /api/system/getConf endpoint.