CVE-2026-72794: SiYuan Auth Bypass Vulnerability

CVE-2026-72794 Overview

CVE-2026-72794 affects SiYuan, a self-hosted personal knowledge management application, in versions before v3.7.4. The /api/system/getConf endpoint exposes the session cookie signing key (CookieKey) to unauthenticated users when the instance runs in publish mode. Attackers who retrieve this key can forge valid session cookies. Forged cookies allow attackers to impersonate legitimate users and obtain administrative access to the application. The flaw is tracked under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Unauthenticated remote attackers can extract the session signing key and forge administrator sessions on any exposed SiYuan instance running in publish mode.

Affected Products

SiYuan versions prior to v3.7.4
SiYuan instances running in publish mode
Self-hosted deployments exposed to untrusted networks

Discovery Timeline

2026-08-12 - CVE-2026-72794 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72794

Vulnerability Analysis

SiYuan uses a server-side signing key, referred to internally as CookieKey, to sign session cookies. The application exposes system configuration through the /api/system/getConf REST endpoint. In versions before v3.7.4, this endpoint returns the raw CookieKey value in its response payload when the instance is operating in publish mode. The endpoint does not require authentication in that mode, so any network-adjacent attacker can issue a single HTTP request to retrieve the signing secret.

Once the attacker possesses the signing key, they can construct a session cookie for any user identifier and produce a valid signature. The SiYuan server accepts the forged cookie as authentic because the signature verifies correctly. This yields full account takeover, including administrative accounts.

Root Cause

The root cause is improper exposure of a sensitive credential through a configuration disclosure endpoint. The getConf handler serializes the entire server configuration object, including the session signing secret, without filtering fields that should remain server-side. Compounding the exposure, publish mode removes authentication requirements from the endpoint, converting an internal configuration reader into an unauthenticated secret disclosure primitive.

Attack Vector

An attacker sends an unauthenticated HTTP GET request to /api/system/getConf on a SiYuan instance running in publish mode. The response contains the CookieKey value. The attacker then generates a signed session cookie using the disclosed key and submits it in subsequent requests. The server treats the request as originating from an authenticated user. No user interaction, prior credentials, or special network position is required beyond reachability of the SiYuan HTTP interface.

See the GitHub Security Advisory and the VulnCheck Advisory for additional technical details.

Detection Methods for CVE-2026-72794

Indicators of Compromise

HTTP requests to /api/system/getConf from external or untrusted IP addresses, particularly with no prior authenticated session
Session cookies presented by clients that never completed a login flow against the SiYuan authentication endpoint
Administrative actions performed from IP addresses or user agents not previously associated with the account

Detection Strategies

Inspect reverse proxy and web server access logs for unauthenticated GET requests to /api/system/getConf
Correlate access to the configuration endpoint with subsequent privileged API calls from the same client
Alert on SiYuan instances responding to /api/system/getConf with 200 OK for anonymous requests

Monitoring Recommendations

Track publish mode configuration state across all SiYuan deployments and alert on unexpected enablement
Monitor outbound traffic from SiYuan hosts for signs of data exfiltration following configuration access
Retain HTTP request and response metadata to support post-incident forensic reconstruction of cookie forgery

How to Mitigate CVE-2026-72794

Immediate Actions Required

Upgrade SiYuan to v3.7.4 or later on all affected instances
Rotate the CookieKey value after upgrading to invalidate any previously forged session cookies
Audit administrative accounts and recent privileged actions for signs of unauthorized access

Patch Information

SiYuan v3.7.4 removes the CookieKey field from the /api/system/getConf response and restricts sensitive configuration data from unauthenticated callers. Administrators should apply the update from the official SiYuan release channel and validate that publish mode no longer discloses the signing secret. Refer to the GitHub Security Advisory GHSA-34fj-mwm6-fjfg for the fix details.

Workarounds

Disable publish mode until the upgrade to v3.7.4 is applied
Place SiYuan behind an authenticated reverse proxy that blocks anonymous requests to /api/system/getConf
Restrict network access to the SiYuan HTTP interface using firewall rules or VPN-only reachability

bash

# Example nginx rule to block anonymous access to the vulnerable endpoint
location = /api/system/getConf {
    deny all;
    return 403;
}