CVE-2026-72793: SiYuan Privilege Escalation Vulnerability

CVE-2026-72793 Overview

CVE-2026-72793 is an information disclosure vulnerability in SiYuan, an open-source personal knowledge management application. Versions before v3.7.4 fail to mask sensitive configuration fields returned by the /api/system/getConf endpoint. Anonymous users and publish-reader accounts can retrieve the session-cookie signing key, the OS username exposed through the pandoc path, and encrypted-notebook key material. Attackers use the leaked signing key to forge session cookies and impersonate legitimate users. On instances deployed without an access-auth code configured, the attacker escalates to administrator privileges.

Critical Impact
Unauthenticated attackers can extract session-signing keys through a public API endpoint and forge administrator cookies on SiYuan instances lacking access-auth codes.

Affected Products

SiYuan versions prior to v3.7.4
SiYuan self-hosted deployments exposed to untrusted networks
SiYuan publish-reader configurations without access-auth codes

Discovery Timeline

2026-08-12 - CVE-2026-72793 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72793

Vulnerability Analysis

The vulnerability resides in the /api/system/getConf endpoint, which returns the full application configuration without redacting sensitive fields. The endpoint is accessible to anonymous callers and to publish-reader users, which are the lowest-privilege role in SiYuan. The response includes the HMAC signing key used to authenticate session cookies, the operating-system username inferred from the pandoc binary path, and key material used to encrypt notebooks.

Once the signing key is exposed, an attacker constructs a valid session cookie for any user identifier. On instances that skip the access-auth code, the attacker forges an administrator cookie and takes full control of the workspace. This weakness is categorized as insufficiently protected credentials [CWE-522].

Root Cause

The root cause is missing output filtering on a public configuration endpoint. The API handler serializes the internal configuration structure directly to JSON without applying a secret-masking policy. Fields intended for server-side use only are treated the same as user-facing configuration values.

Attack Vector

Exploitation requires network access to the SiYuan HTTP interface and no authentication. An attacker issues an HTTP request to /api/system/getConf, parses the JSON response, and extracts the signing-key field. The attacker then uses the key to craft a session cookie for the admin user and replays it against authenticated endpoints. See the GitHub Security Advisory and the VulnCheck Advisory on API Disclosure for the endpoint behavior and field-level details.

Detection Methods for CVE-2026-72793

Indicators of Compromise

Unauthenticated HTTP requests to /api/system/getConf from external or unexpected source IPs.
Session cookies presented by clients that never completed an interactive login sequence.
Administrator actions originating from IP addresses not previously associated with admin users.

Detection Strategies

Alert on any access to /api/system/getConf from source addresses outside the trusted management network.
Correlate getConf responses with subsequent authenticated API calls from the same IP within a short window.
Baseline the SiYuan version string exposed by the application and flag deployments running below v3.7.4.

Monitoring Recommendations

Log all requests to /api/system/* with full URI, source IP, and response size to catch bulk configuration reads.
Monitor for privileged operations performed without a preceding authentication event in the same session.
Track outbound requests from SiYuan hosts that follow immediately after getConf calls, which may indicate automated exploitation.

How to Mitigate CVE-2026-72793

Immediate Actions Required

Upgrade all SiYuan instances to v3.7.4 or later without delay.
Rotate the session-cookie signing key and any encrypted-notebook keys after upgrading.
Configure an access-auth code on every internet-reachable SiYuan deployment.
Invalidate existing session cookies to force reauthentication on all clients.

Patch Information

SiYuan v3.7.4 masks sensitive configuration fields in the /api/system/getConf response. Refer to the GitHub Security Advisory GHSA-h4v5-crx2-3cv4 for the maintainer's fix notes and upgrade guidance.

Workarounds

Restrict network access to the SiYuan HTTP interface using a reverse proxy or firewall allowlist.
Require an access-auth code for all users and disable the publish-reader role where not needed.
Block requests to /api/system/getConf at the reverse proxy for unauthenticated clients as a temporary control.

bash

# Example nginx rule to block unauthenticated access to the vulnerable endpoint
location = /api/system/getConf {
    allow 10.0.0.0/8;
    deny all;
}